From nobody Mon Feb 9 03:17:29 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; dkim=fail spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1495193584905825.7991127125063; Fri, 19 May 2017 04:33:04 -0700 (PDT) Received: from localhost ([::1]:57978 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dBg9X-0005wW-CV for importer@patchew.org; Fri, 19 May 2017 07:33:03 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49505) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dBfyS-0004VB-L8 for qemu-devel@nongnu.org; Fri, 19 May 2017 07:21:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dBfyR-0000zz-J7 for qemu-devel@nongnu.org; Fri, 19 May 2017 07:21:36 -0400 Received: from mail-wm0-x242.google.com ([2a00:1450:400c:c09::242]:33997) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dBfyR-0000zi-DK; Fri, 19 May 2017 07:21:35 -0400 Received: by mail-wm0-x242.google.com with SMTP id d127so17623458wmf.1; Fri, 19 May 2017 04:21:35 -0700 (PDT) Received: from 640k.lan (94-39-157-43.adsl-ull.clienti.tiscali.it. [94.39.157.43]) by smtp.gmail.com with ESMTPSA id v65sm2640095wmv.5.2017.05.19.04.21.33 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 19 May 2017 04:21:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=rZPd2EpwCr0E+hKxm3dgk1klNysbub8Vv+9emWkUwIQ=; b=u4mrVZfjQW9CTb82VKhp8lL9vz/cd+r0Rac6fETQ+wFFSOujM4IWs57+yPLvGEWm/2 ZZ6RXKt7yYGemzFzE7dW1WGNdzAFkex1IdclxTHFXfx9/m27X9UYM7Pz1n/+KCHH3GXN q/lhI06wiUmPU2/IcSsgrkOPmzcws2fuYdnQBve7baddpBWJPUmuhy2rsUmQnCzrjkT1 bOKQQD6fMDJ8AuAAvpgYVIogmbwXqWGLDrBwuI+gnWQ3T1t5lNV5JxFvxAYJb+db4lNW fZP7VuAvKWVA06yxj/dvy/Eh8bDIYwV6NsHDRb6zg0A+V3Q+uekbaSlZ4cCmOMMqGoWX 18Ng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=rZPd2EpwCr0E+hKxm3dgk1klNysbub8Vv+9emWkUwIQ=; b=SFsQdbAIuAjj8ET2Hk7tdW06YLn+On3+ai9c3jIY81TrAp/aJZc2pbJ6fh2ij9jDWU UofKDxa0Kh7hYtK4PeHHs3UtEOt6mz5hgwk+T0qQTTTBQKy3o9KkV5w0Oq3lUWaSxTJO a+cALSGwKst2lI7410wed9HTPhqi6kzlKTFgOILEuLlIPL40VIxWmUXMhwMLF2gQZ/bN JvtltBgYlY16WHmBgE5sS2rP7fob19LuZTcQ3wqmxKT1Em/0QC5BKOXqKzpdSDGWwwst G/BH0eYczAWOIXLFTvOnZfGaEG0fEQydQnKb/yMsJbC8JrGmeC+QsiBXji8E5PXzRliE g9rQ== X-Gm-Message-State: AODbwcCfyc9r3PAzh6fM9sHoBbFpclP2u/4tmnJ+c+pXd0ZFBW9uFaBl jc6Qnda26AcVtNspvGc= X-Received: by 10.28.63.209 with SMTP id m200mr16910104wma.45.1495192894229; Fri, 19 May 2017 04:21:34 -0700 (PDT) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Fri, 19 May 2017 13:21:08 +0200 Message-Id: <1495192872-27667-17-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1495192872-27667-1-git-send-email-pbonzini@redhat.com> References: <1495192872-27667-1-git-send-email-pbonzini@redhat.com> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2a00:1450:400c:c09::242 Subject: [Qemu-devel] [PULL 16/20] virtio-scsi: Unset hotplug handler when unrealize X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Fam Zheng , qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Fam Zheng This matches the qbus_set_hotplug_handler in realize, and it releases the final reference to the embedded VirtIODevice so that it is properly finalized. A use-after-free is fixed with this patch, indirectly: virtio_device_instance_finalize wasn't called at hot-unplug, and the vdev->listener would be a dangling pointer in the global and the per address space listener list. See also RHBZ 1449031. Cc: qemu-stable@nongnu.org Signed-off-by: Fam Zheng Message-Id: <20170518102808.30046-1-famz@redhat.com> Signed-off-by: Paolo Bonzini --- hw/scsi/virtio-scsi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index 46a3e3f..f46f06d 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -918,6 +918,9 @@ void virtio_scsi_common_unrealize(DeviceState *dev, Err= or **errp) =20 static void virtio_scsi_device_unrealize(DeviceState *dev, Error **errp) { + VirtIOSCSI *s =3D VIRTIO_SCSI(dev); + + qbus_set_hotplug_handler(BUS(&s->bus), NULL, &error_abort); virtio_scsi_common_unrealize(dev, errp); } =20 --=20 1.8.3.1