From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: KVM: fix cleanup_srcu_struct use-after-free Date: Sun, 17 Jan 2010 14:28:34 +0200 Message-ID: <4B530272.2020704@redhat.com> References: <20100116020040.GA4611@amt.cnet> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: kvm To: Marcelo Tosatti Return-path: Received: from mx1.redhat.com ([209.132.183.28]:35907 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753358Ab0AQM2g (ORCPT ); Sun, 17 Jan 2010 07:28:36 -0500 Received: from int-mx04.intmail.prod.int.phx2.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.17]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o0HCSaRv017604 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Sun, 17 Jan 2010 07:28:36 -0500 In-Reply-To: <20100116020040.GA4611@amt.cnet> Sender: kvm-owner@vger.kernel.org List-ID: On 01/16/2010 04:00 AM, Marcelo Tosatti wrote: > kvm_destroy_vm should free "struct kvm" after cleanup_srcu_struct. > > Signed-off-by: Marcelo Tosatti > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index e0a591d..c828a39 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -509,8 +509,8 @@ static void kvm_destroy_vm(struct kvm *kvm) > #else > kvm_arch_flush_shadow(kvm); > #endif > - kvm_arch_destroy_vm(kvm); > cleanup_srcu_struct(&kvm->srcu); > + kvm_arch_destroy_vm(kvm); > hardware_disable_all(); > mmdrop(mm); > } > Applied, thanks. -- error compiling committee.c: too many arguments to function