Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit

[Anthony Liguori <aliguori@us.ibm.com>]

On 09/30/2011 10:26 AM, Stefan Hajnoczi wrote:
> On Fri, Sep 30, 2011 at 11:39 AM, Stefan Hajnoczi
> <stefanha@linux.vnet.ibm.com>  wrote:
>> QED's metadata caching strategy allows two parallel requests to race for
>> metadata lookup.  The first one to complete will populate the metadata
>> cache and the second one will drop the data it just read in favor of the
>> cached data.
>>
>> There is a use-after-free in qed_read_l2_table_cb() and
>> qed_commit_l2_update() where l2_table->offset was used after the
>> l2_table may have been freed due to a metadata lookup race.  Fix this by
>> keeping the l2_offset in a local variable and not reaching into the
>> possibly freed l2_table.
>>
>> Reported-by: Amit Shah<amit.shah@redhat.com>
>> Signed-off-by: Stefan Hajnoczi<stefanha@linux.vnet.ibm.com>
>
> Please consider this for -stable.  It's a pretty small/simple fix and
> can prevent an assertion failure.

Justin is looking to cut a stable release this week.  Since Kevin is out on 
holiday, unless anyone objects, I'll commit this so that it can make the next 
stable release.

Regards,

Anthony Liguori

>
> Stefan
>
>