Re: [RFC v2 4/7] vhost: Add VhostShadowVirtqueue

From: Stefan Hajnoczi <stefanha@redhat.com>
To: "Eugenio Pérez" <eperezma@redhat.com>
Cc: Rob Miller <rob.miller@broadcom.com>,
	Parav Pandit <parav@mellanox.com>,
	"Michael S. Tsirkin" <mst@redhat.com>,
	qemu-devel@nongnu.org, Harpreet Singh Anand <hanand@xilinx.com>,
	Xiao W Wang <xiao.w.wang@intel.com>, Eli Cohen <eli@mellanox.com>,
	virtualization@lists.linux-foundation.org,
	Eric Blake <eblake@redhat.com>, Michael Lilja <ml@napatech.com>,
	Jim Harford <jim.harford@broadcom.com>
Subject: Re: [RFC v2 4/7] vhost: Add VhostShadowVirtqueue
Date: Wed, 17 Feb 2021 13:01:08 +0000	[thread overview]
Message-ID: <20210217130108.GF269203@stefanha-x1.localdomain> (raw)
In-Reply-To: <20210209153757.1653598-5-eperezma@redhat.com>

[-- Attachment #1.1: Type: text/plain, Size: 1077 bytes --]

On Tue, Feb 09, 2021 at 04:37:54PM +0100, Eugenio Pérez wrote:
> +/*
> + * Creates vhost shadow virtqueue, and instruct vhost device to use the shadow
> + * methods and file descriptors.
> + */
> +VhostShadowVirtqueue *vhost_shadow_vq_new(struct vhost_dev *dev, int idx)
> +{
> +    g_autofree VhostShadowVirtqueue *svq = g_new0(VhostShadowVirtqueue, 1);
> +    int r;
> +
> +    r = event_notifier_init(&svq->kick_notifier, 0);
> +    if (r != 0) {
> +        error_report("Couldn't create kick event notifier: %s",
> +                     strerror(errno));
> +        goto err_init_kick_notifier;
> +    }
> +
> +    r = event_notifier_init(&svq->call_notifier, 0);
> +    if (r != 0) {
> +        error_report("Couldn't create call event notifier: %s",
> +                     strerror(errno));
> +        goto err_init_call_notifier;
> +    }
> +
> +    return svq;

Use-after-free due to g_autofree. I think this should be:

  return g_steal_pointer(&svq)

https://developer.gnome.org/glib/stable/glib-Memory-Allocation.html#g-steal-pointer

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 183 bytes --]

_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization