openkylin
/
qemu
mirror of https://gitee.com/openkylin/qemu.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

hw/vfio/pci: fix double free in vfio_msi_disable 

The following guest behaviour patter leads to double free in VFIO PCI:

1. Guest enables MSI interrupts
vfio_msi_enable is called, but fails in vfio_enable_vectors.
In our case this was because VFIO GPU device was in D3 state.
Unhappy path in vfio_msi_enable will g_free(vdev->msi_vectors) but not
set this pointer to NULL

2. Guest still sees MSI an enabled after that because emulated config
write is done in vfio_pci_write_config unconditionally before calling
vfio_msi_enable

3. Guest disables MSI interrupts
vfio_msi_disable is called and tries to g_free(vdev->msi_vectors)
in vfio_msi_disable_common => double free

Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
This commit is contained in:
Evgeny Yakovlev 2019-10-10 11:07:28 -06:00 committed by Alex Williamson
parent 98b2e3c9ab
commit d964d3b5ab
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
hw/vfio/pci.c
View File

@ -651,6 +651,7 @@ retry:
}
g_free(vdev->msi_vectors);
vdev->msi_vectors = NULL;
if (ret > 0 && ret != vdev->nr_vectors) {
vdev->nr_vectors = ret;