* Re: [PATCH net-XXX] vhost-vdpa: fix use after free in vhost_vdpa_probe()
[not found] <cf53cb61-0699-4e36-a980-94fd4268ff00@moroto.mountain>
@ 2023-11-01 4:36 ` Jason Wang
2023-11-01 5:33 ` Michael S. Tsirkin
1 sibling, 0 replies; 2+ messages in thread
From: Jason Wang @ 2023-11-01 4:36 UTC (permalink / raw)
To: Dan Carpenter
Cc: kvm, Michael S. Tsirkin, netdev, kernel-janitors, virtualization,
Bo Liu
On Fri, Oct 27, 2023 at 8:13 PM Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> The put_device() calls vhost_vdpa_release_dev() which calls
> ida_simple_remove() and frees "v". So this call to
> ida_simple_remove() is a use after free and a double free.
>
> Fixes: ebe6a354fa7e ("vhost-vdpa: Call ida_simple_remove() when failed")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Jason Wang <jasowang@redhat.com>
Thanks
> ---
> drivers/vhost/vdpa.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index 9a2343c45df0..1aa67729e188 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -1511,7 +1511,6 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa)
>
> err:
> put_device(&v->dev);
> - ida_simple_remove(&vhost_vdpa_ida, v->minor);
> return r;
> }
>
> --
> 2.42.0
>
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH net-XXX] vhost-vdpa: fix use after free in vhost_vdpa_probe()
[not found] <cf53cb61-0699-4e36-a980-94fd4268ff00@moroto.mountain>
2023-11-01 4:36 ` [PATCH net-XXX] vhost-vdpa: fix use after free in vhost_vdpa_probe() Jason Wang
@ 2023-11-01 5:33 ` Michael S. Tsirkin
1 sibling, 0 replies; 2+ messages in thread
From: Michael S. Tsirkin @ 2023-11-01 5:33 UTC (permalink / raw)
To: Dan Carpenter; +Cc: kvm, netdev, kernel-janitors, virtualization, Bo Liu
On Fri, Oct 27, 2023 at 03:12:54PM +0300, Dan Carpenter wrote:
> The put_device() calls vhost_vdpa_release_dev() which calls
> ida_simple_remove() and frees "v". So this call to
> ida_simple_remove() is a use after free and a double free.
>
> Fixes: ebe6a354fa7e ("vhost-vdpa: Call ida_simple_remove() when failed")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
queued, thanks!
> ---
> drivers/vhost/vdpa.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index 9a2343c45df0..1aa67729e188 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -1511,7 +1511,6 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa)
>
> err:
> put_device(&v->dev);
> - ida_simple_remove(&vhost_vdpa_ida, v->minor);
> return r;
> }
>
> --
> 2.42.0
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply [flat|nested] 2+ messages in thread