From nobody Wed Nov 5 11:35:23 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; dkim=fail spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 149819212728868.29884904100652; Thu, 22 Jun 2017 21:28:47 -0700 (PDT) Received: from localhost ([::1]:33529 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dOGD7-0002G3-Hp for importer@patchew.org; Fri, 23 Jun 2017 00:28:45 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45234) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dOEzt-0003Of-L1 for qemu-devel@nongnu.org; Thu, 22 Jun 2017 23:11:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dOEzq-0005de-Af for qemu-devel@nongnu.org; Thu, 22 Jun 2017 23:11:01 -0400 Received: from synology.com ([59.124.61.242]:58049) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dOEzp-0004od-MG for qemu-devel@nongnu.org; Thu, 22 Jun 2017 23:10:58 -0400 From: Jia-Shiun Li DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=synology.com; s=123; t=1498187433; bh=IhpKfLuz1FZZjE5/GIkPV4SdKa2Luc6EKFdysH6/JPo=; h=From:To:Cc:Subject:Date; b=LASyKdPgTPQchJf0dlhfkzz1e5r1ThCSCWobDxRJ5hjow30Guu2dW+0njSYug+qaV kh4T1lpLSpGGT6IIbPHDMEl+m0OkBzePhO3+o1dyMYnmQccxKpgP+3YJ5HdMCtFBlG R483YjxcaH2zsy+Z80JGrQgLe74XXDyHXOy802Ro= To: mst@redhat.com Date: Fri, 23 Jun 2017 11:09:57 +0800 Message-Id: <1498187397-127781-1-git-send-email-jsli@synology.com> X-MailScanner-ID: 74F31872402B.A7326 X-MailScanner: Found to be clean X-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (score=0, required 80) X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (cached, score=-2.001, required 4.5, BAYES_00 -1.90, DKIM_SIGNED 0.10, DKIM_VALID -0.10, DKIM_VALID_AU -0.10, NO_RECEIVED -0.00, NO_RELAYS -0.00, URIBL_BLOCKED 0.00) X-MailScanner-From: jsli@synology.com X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 59.124.61.242 X-Mailman-Approved-At: Fri, 23 Jun 2017 00:27:19 -0400 Subject: [Qemu-devel] [PATCH] vhost: Fix use-after-free in vhost_log_put() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jia-Shiun Li , qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" In commit 9e0bc24f dev->log_size was reset to zero too early before syncing vhost log. It causes syncing to be skipped. Move it to clear dev->log* after use. Signed-off-by: Jia-Shiun Li --- hw/virtio/vhost.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 6eddb09..c9ddf11 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -375,8 +375,6 @@ static void vhost_log_put(struct vhost_dev *dev, bool s= ync) if (!log) { return; } - dev->log =3D NULL; - dev->log_size =3D 0; =20 --log->refcnt; if (log->refcnt =3D=3D 0) { @@ -396,6 +394,8 @@ static void vhost_log_put(struct vhost_dev *dev, bool s= ync) =20 g_free(log); } + dev->log =3D NULL; + dev->log_size =3D 0; } =20 static bool vhost_dev_log_is_shared(struct vhost_dev *dev) --=20 2.7.4