Re: [PATCH] vfio: fix possible use after free of vfio group

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 14 Jul 2016 16:50:19 +0300
Ilya Lesokhin <ilyal@xxxxxxxxxxxx> wrote:

> The vfio group should be released after
> the vfio_group_try_dissolve_container call.
> The code should not rely on someone else to hold
> a reference on the group.
> 
> Signed-off-by: Ilya Lesokhin <ilyal@xxxxxxxxxxxx>
> ---
>  drivers/vfio/vfio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index 6fd6fa5..d1d70e0 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -1711,8 +1711,8 @@ EXPORT_SYMBOL_GPL(vfio_group_get_external_user);
>  
>  void vfio_group_put_external_user(struct vfio_group *group)
>  {
> -	vfio_group_put(group);
>  	vfio_group_try_dissolve_container(group);
> +	vfio_group_put(group);
>  }
>  EXPORT_SYMBOL_GPL(vfio_group_put_external_user);
>  

Yep, I think you're right.  @group can clearly be freed via
vfio_group_put() and this ordering matches vfio_group_fops_release().
I suspect this ordering was based on reversing how
vfio_group_get_external_user() works, but with that function the caller
has a file reference to the group so we can delay acquiring another
group reference until we've worked through all the container usage exit
cases.  I'll do some testing and apply to my next branch for v4.8 if
all goes well.  Thanks!

Alex
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux