From nobody Mon Apr 29 13:18:09 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; dkim=fail spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1498824298333623.9512712303975; Fri, 30 Jun 2017 05:04:58 -0700 (PDT) Received: from localhost ([::1]:44214 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dQufM-0000Fl-QV for importer@patchew.org; Fri, 30 Jun 2017 08:04:52 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53044) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dQueN-0008Cn-Ri for qemu-devel@nongnu.org; Fri, 30 Jun 2017 08:03:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dQueI-0007g1-Vn for qemu-devel@nongnu.org; Fri, 30 Jun 2017 08:03:51 -0400 Received: from synology.com ([59.124.61.242]:51867) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dQueI-0007ev-IW for qemu-devel@nongnu.org; Fri, 30 Jun 2017 08:03:46 -0400 From: Jia-Shiun Li DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=synology.com; s=123; t=1498824208; bh=oQRN9A0SAdqZWTwTfrYi7UFrsyem7Z3w26A4gmfa4LA=; h=From:To:Cc:Subject:Date; b=BD5YbmIXxhfcEOeNcfr6rq+N7QxdYrueIBshOTm63f8F9d1uWv/jX2J3bAm6oFlqJ QFVukFno4gbbR0bIQqmNuCxptPImeNNgMJ3nYB6ObbGutjXsvm3tk6bK9ax8IR2fcZ CtCpwqD55ghoILJhRuvTRwYwMBtz80UXxgcjTiwM= To: marcandre.lureau@gmail.com, mst@redhat.com Date: Fri, 30 Jun 2017 20:03:04 +0800 Message-Id: <1498824184-1249-1-git-send-email-jsli@synology.com> X-MailScanner-ID: 0BAB719B3074A.A9786 X-MailScanner: Found to be clean X-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (score=0, required 80) X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (cached, score=-0.102, required 4.5, BAYES_20 -0.00, DKIM_SIGNED 0.10, DKIM_VALID -0.10, DKIM_VALID_AU -0.10, NO_RECEIVED -0.00, NO_RELAYS -0.00, URIBL_BLOCKED 0.00) X-MailScanner-From: jsli@synology.com X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 59.124.61.242 Subject: [Qemu-devel] [PATCH v2] vhost: Fix use-after-free in vhost_log_put() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jia-Shiun Li , qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" In commit 9e0bc24f dev->log_size was reset to zero too early before syncing vhost log. It causes syncing to be skipped. Use local variable to keep its value before resetting. Signed-off-by: Jia-Shiun Li --- v1 -> v2: * Use local variable to keep value of dev->log_size. --- hw/virtio/vhost.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 6eddb09..c1c5714 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -371,6 +371,7 @@ static struct vhost_log *vhost_log_get(uint64_t size, b= ool share) static void vhost_log_put(struct vhost_dev *dev, bool sync) { struct vhost_log *log =3D dev->log; + uint64_t log_size =3D dev->log_size; =20 if (!log) { return; @@ -381,8 +382,8 @@ static void vhost_log_put(struct vhost_dev *dev, bool s= ync) --log->refcnt; if (log->refcnt =3D=3D 0) { /* Sync only the range covered by the old log */ - if (dev->log_size && sync) { - vhost_log_sync_range(dev, 0, dev->log_size * VHOST_LOG_CHUNK -= 1); + if (log_size && sync) { + vhost_log_sync_range(dev, 0, log_size * VHOST_LOG_CHUNK - 1); } =20 if (vhost_log =3D=3D log) { --=20 2.7.4