* [PATCH] vfio: fix possible use after free of vfio group
@ 2016-07-14 13:50 Ilya Lesokhin
2016-07-14 19:13 ` Alex Williamson
0 siblings, 1 reply; 2+ messages in thread
From: Ilya Lesokhin @ 2016-07-14 13:50 UTC (permalink / raw)
To: kvm, alex.williamson; +Cc: ilyal
The vfio group should be released after
the vfio_group_try_dissolve_container call.
The code should not rely on someone else to hold
a reference on the group.
Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com>
---
drivers/vfio/vfio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 6fd6fa5..d1d70e0 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -1711,8 +1711,8 @@ EXPORT_SYMBOL_GPL(vfio_group_get_external_user);
void vfio_group_put_external_user(struct vfio_group *group)
{
- vfio_group_put(group);
vfio_group_try_dissolve_container(group);
+ vfio_group_put(group);
}
EXPORT_SYMBOL_GPL(vfio_group_put_external_user);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] vfio: fix possible use after free of vfio group
2016-07-14 13:50 [PATCH] vfio: fix possible use after free of vfio group Ilya Lesokhin
@ 2016-07-14 19:13 ` Alex Williamson
0 siblings, 0 replies; 2+ messages in thread
From: Alex Williamson @ 2016-07-14 19:13 UTC (permalink / raw)
To: Ilya Lesokhin; +Cc: kvm
On Thu, 14 Jul 2016 16:50:19 +0300
Ilya Lesokhin <ilyal@mellanox.com> wrote:
> The vfio group should be released after
> the vfio_group_try_dissolve_container call.
> The code should not rely on someone else to hold
> a reference on the group.
>
> Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com>
> ---
> drivers/vfio/vfio.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index 6fd6fa5..d1d70e0 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -1711,8 +1711,8 @@ EXPORT_SYMBOL_GPL(vfio_group_get_external_user);
>
> void vfio_group_put_external_user(struct vfio_group *group)
> {
> - vfio_group_put(group);
> vfio_group_try_dissolve_container(group);
> + vfio_group_put(group);
> }
> EXPORT_SYMBOL_GPL(vfio_group_put_external_user);
>
Yep, I think you're right. @group can clearly be freed via
vfio_group_put() and this ordering matches vfio_group_fops_release().
I suspect this ordering was based on reversing how
vfio_group_get_external_user() works, but with that function the caller
has a file reference to the group so we can delay acquiring another
group reference until we've worked through all the container usage exit
cases. I'll do some testing and apply to my next branch for v4.8 if
all goes well. Thanks!
Alex
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-07-14 19:13 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-07-14 13:50 [PATCH] vfio: fix possible use after free of vfio group Ilya Lesokhin
2016-07-14 19:13 ` Alex Williamson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).