From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42161) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aOoIL-0003dK-M0 for qemu-devel@nongnu.org; Thu, 28 Jan 2016 10:15:38 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aOoIH-0006if-Bn for qemu-devel@nongnu.org; Thu, 28 Jan 2016 10:15:37 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58416) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aOoIH-0006ia-69 for qemu-devel@nongnu.org; Thu, 28 Jan 2016 10:15:33 -0500 From: P J P Date: Thu, 28 Jan 2016 20:45:25 +0530 Message-Id: <1453994125-23586-1-git-send-email-ppandit@redhat.com> Subject: [Qemu-devel] [PATCH] exec: check 'bounce.in_use' flag before using buffer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: QEMU Developers Cc: Paolo Bonzini , John Snow , Prasad J Pandit , Zuozhi fzz From: Prasad J Pandit When IDE AHCI emulation uses Frame Information Structures(FIS) engine for data transfer, the mapped FIS buffer address is stored in a static 'bounce.buffer'. This is freed when FIS entry is unmapped. If multiple FIS entries are created, it leads to an use after free error. Check 'bounce.in_use' flag to avoid it. Reported-by: Zuozhi fzz Signed-off-by: Prasad J Pandit --- exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/exec.c b/exec.c index 8718a75..ccc5715 100644 --- a/exec.c +++ b/exec.c @@ -2922,7 +2922,7 @@ void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len, memory_region_unref(mr); return; } - if (is_write) { + if (bounce.in_use && is_write) { address_space_write(as, bounce.addr, MEMTXATTRS_UNSPECIFIED, bounce.buffer, access_len); } -- 2.5.0