From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasha Levin Subject: [PATCH AUTOSEL 4.19 596/671] vhost/test: stop device before reset Date: Thu, 16 Jan 2020 12:03:54 -0500 Message-ID: <20200116170509.12787-333-sashal@kernel.org> References: <20200116170509.12787-1-sashal@kernel.org> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <20200116170509.12787-1-sashal@kernel.org> Sender: linux-kernel-owner@vger.kernel.org To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: "Michael S. Tsirkin" , Sasha Levin , kvm@vger.kernel.org, virtualization@lists.linux-foundation.org, netdev@vger.kernel.org List-Id: virtualization@lists.linuxfoundation.org From: "Michael S. Tsirkin" [ Upstream commit 245cdd9fbd396483d501db83047116e2530f245f ] When device stop was moved out of reset, test device wasn't updated to stop before reset, this resulted in a use after free. Fix by invoking stop appropriately. Fixes: b211616d7125 ("vhost: move -net specific code out") Signed-off-by: Michael S. Tsirkin Signed-off-by: Sasha Levin --- drivers/vhost/test.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c index a9be2d8e98df..55090d9f9de0 100644 --- a/drivers/vhost/test.c +++ b/drivers/vhost/test.c @@ -162,6 +162,7 @@ static int vhost_test_release(struct inode *inode, struct file *f) vhost_test_stop(n, &private); vhost_test_flush(n); + vhost_dev_stop(&n->dev); vhost_dev_cleanup(&n->dev); /* We do an extra flush before freeing memory, * since jobs can re-queue themselves. */ @@ -238,6 +239,7 @@ static long vhost_test_reset_owner(struct vhost_test *n) } vhost_test_stop(n, &priv); vhost_test_flush(n); + vhost_dev_stop(&n->dev); vhost_dev_reset_owner(&n->dev, umem); done: mutex_unlock(&n->dev.mutex); -- 2.20.1