diff options
| author | Evgeny Yakovlev <wrfsh@yandex-team.ru> | 2019-10-10 11:07:28 -0600 |
|---|---|---|
| committer | Alex Williamson <alex.williamson@redhat.com> | 2019-10-10 11:07:28 -0600 |
| commit | d964d3b5abb5242591a088dacb1dc01e608b5158 (patch) | |
| tree | 08b3c0492747256db195064e6960cefb1de98f57 /fsdev/qemu-fsdev.c | |
| parent | 98b2e3c9ab3abfe476a2b02f8f51813edb90e72d (diff) | |
| download | focaccia-qemu-d964d3b5abb5242591a088dacb1dc01e608b5158.tar.gz focaccia-qemu-d964d3b5abb5242591a088dacb1dc01e608b5158.zip | |
hw/vfio/pci: fix double free in vfio_msi_disable
The following guest behaviour patter leads to double free in VFIO PCI: 1. Guest enables MSI interrupts vfio_msi_enable is called, but fails in vfio_enable_vectors. In our case this was because VFIO GPU device was in D3 state. Unhappy path in vfio_msi_enable will g_free(vdev->msi_vectors) but not set this pointer to NULL 2. Guest still sees MSI an enabled after that because emulated config write is done in vfio_pci_write_config unconditionally before calling vfio_msi_enable 3. Guest disables MSI interrupts vfio_msi_disable is called and tries to g_free(vdev->msi_vectors) in vfio_msi_disable_common => double free Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Diffstat (limited to 'fsdev/qemu-fsdev.c')
0 files changed, 0 insertions, 0 deletions