From: Rusty Russell <rusty@rustcorp.com.au>
To: "Michael S. Tsirkin" <mst@redhat.com>,
"Michael S. Tsirkin" <mst@redhat.com>,
virtualization@lists.linux-foundation.org,
linux-kernel@vger.kernel.org
Cc: stable@kernel.org
Subject: Re: [PATCH] virtio-pci: fix use after free
Date: Tue, 08 Nov 2011 09:42:01 +1030 [thread overview]
Message-ID: <87fwhzsf26.fsf@rustcorp.com.au> (raw)
In-Reply-To: <20111107163703.GA10358@redhat.com>
On Mon, 7 Nov 2011 18:37:05 +0200, "Michael S. Tsirkin" <mst@redhat.com> wrote:
> Commit 31a3ddda166cda86d2b5111e09ba4bda5239fae6 introduced
> a use after free in virtio-pci. The main issue is
> that the release method signals removal of the virtio device,
> while remove signals removal of the pci device.
>
> For example, on driver removal or hot-unplug,
> virtio_pci_release_dev is called before virtio_pci_remove.
> We then might get a crash as virtio_pci_remove tries to use the
> device freed by virtio_pci_release_dev.
>
> We allocate/free all resources together with the
> pci device, so we can leave the release method empty.
>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Applied, thanks. Will push once it's spent a day in linux-next.
Thanks,
Rusty.
next prev parent reply other threads:[~2011-11-08 6:26 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-07 16:37 [PATCH] virtio-pci: fix use after free Michael S. Tsirkin
2011-11-07 23:12 ` Rusty Russell [this message]
2011-11-08 5:46 ` Amit Shah
2011-11-08 10:19 ` Rusty Russell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87fwhzsf26.fsf@rustcorp.com.au \
--to=rusty@rustcorp.com.au \
--cc=linux-kernel@vger.kernel.org \
--cc=mst@redhat.com \
--cc=stable@kernel.org \
--cc=virtualization@lists.linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox