From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rusty Russell Subject: Re: [PATCH] virtio_pci: Prevent double-free of pci regions after device hot-unplug Date: Wed, 16 Mar 2011 14:34:58 +1030 Message-ID: <871v27iuc5.fsf@rustcorp.com.au> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: virtualization-bounces@lists.linux-foundation.org Errors-To: virtualization-bounces@lists.linux-foundation.org Cc: Amit Shah , Mark McLoughlin , Virtualization List , "Michael S. Tsirkin" List-Id: virtualization@lists.linuxfoundation.org On Mon, 14 Mar 2011 17:45:02 +0530, Amit Shah wrote: > In the case where a virtio-console port is in use (opened by a program) > and a virtio-console device is removed, the port is kept around but all > the virtio-related state is assumed to be gone. > > When the port is finally released (close() called), we call > device_destroy() on the port's device. This results in the parent > device's structures to be freed as well. This includes the PCI regions > for the virtio-console PCI device. > > Once this is done, however, virtio_pci_release_dev() kicks in, as the > last ref to the virtio device is now gone, and attempts to do > > pci_iounmap(pci_dev, vp_dev->ioaddr); > pci_release_regions(pci_dev); > pci_disable_device(pci_dev); > > which results in a double-free warning. > > Move the code that releases regions, etc., to the virtio_pci_remove() > function, and all that's now left in release_dev is the final freeing of > the vp_dev. > > Signed-off-by: Amit Shah Applied. Thanks, Rusty.