[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit

From: Stefan Hajnoczi
Subject: Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit
Date: Fri, 30 Sep 2011 16:26:00 +0100

On Fri, Sep 30, 2011 at 11:39 AM, Stefan Hajnoczi
<address@hidden> wrote:
> QED's metadata caching strategy allows two parallel requests to race for
> metadata lookup.  The first one to complete will populate the metadata
> cache and the second one will drop the data it just read in favor of the
> cached data.
> There is a use-after-free in qed_read_l2_table_cb() and
> qed_commit_l2_update() where l2_table->offset was used after the
> l2_table may have been freed due to a metadata lookup race.  Fix this by
> keeping the l2_offset in a local variable and not reaching into the
> possibly freed l2_table.
> Reported-by: Amit Shah <address@hidden>
> Signed-off-by: Stefan Hajnoczi <address@hidden>

Please consider this for -stable.  It's a pretty small/simple fix and
can prevent an assertion failure.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]