Re: [PATCH] vfio/pci: Fix a use-after-free issue

["Cédric Le Goater" <clg@redhat.com>]

On 5/16/23 05:43, Zhenzhong Duan wrote:
> We should free the duplicated variant of vbasedev->name plus uuid
> rather than vbasedev->name itself.
> 
> Fixes: 2dca1b37a7 ("vfio/pci: add support for VF toke")

"toke" -> "token"

> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
> ---
>   hw/vfio/pci.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
> index bf27a3990564..d2593681e000 100644
> --- a/hw/vfio/pci.c
> +++ b/hw/vfio/pci.c
> @@ -2998,7 +2998,9 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
>       }
>   
>       ret = vfio_get_device(group, name, vbasedev, errp);
> -    g_free(name);
> +    if (name != vbasedev->name) {


yes. I wonder if we shouldn't use the same test with which 'name' was
allocated instead :

     if (!qemu_uuid_is_null(&vdev->vf_token)) {

Thanks,

C.


> +        g_free(name);
> +    }
>       if (ret) {
>           vfio_put_group(group);
>           goto error;