From: Alex Williamson <alex.williamson@redhat.com>
To: Ilya Lesokhin <ilyal@mellanox.com>
Cc: kvm@vger.kernel.org
Subject: Re: [PATCH] vfio: fix possible use after free of vfio group
Date: Thu, 14 Jul 2016 13:13:43 -0600 [thread overview]
Message-ID: <20160714131343.58536a54@t450s.home> (raw)
In-Reply-To: <1468504219-15421-1-git-send-email-ilyal@mellanox.com>
On Thu, 14 Jul 2016 16:50:19 +0300
Ilya Lesokhin <ilyal@mellanox.com> wrote:
> The vfio group should be released after
> the vfio_group_try_dissolve_container call.
> The code should not rely on someone else to hold
> a reference on the group.
>
> Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com>
> ---
> drivers/vfio/vfio.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index 6fd6fa5..d1d70e0 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -1711,8 +1711,8 @@ EXPORT_SYMBOL_GPL(vfio_group_get_external_user);
>
> void vfio_group_put_external_user(struct vfio_group *group)
> {
> - vfio_group_put(group);
> vfio_group_try_dissolve_container(group);
> + vfio_group_put(group);
> }
> EXPORT_SYMBOL_GPL(vfio_group_put_external_user);
>
Yep, I think you're right. @group can clearly be freed via
vfio_group_put() and this ordering matches vfio_group_fops_release().
I suspect this ordering was based on reversing how
vfio_group_get_external_user() works, but with that function the caller
has a file reference to the group so we can delay acquiring another
group reference until we've worked through all the container usage exit
cases. I'll do some testing and apply to my next branch for v4.8 if
all goes well. Thanks!
Alex
prev parent reply other threads:[~2016-07-14 19:13 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-14 13:50 [PATCH] vfio: fix possible use after free of vfio group Ilya Lesokhin
2016-07-14 19:13 ` Alex Williamson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160714131343.58536a54@t450s.home \
--to=alex.williamson@redhat.com \
--cc=ilyal@mellanox.com \
--cc=kvm@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).