diff options
| author | Evgeny Yakovlev | 2019-10-10 19:07:28 +0200 |
|---|---|---|
| committer | Alex Williamson | 2019-10-10 19:07:28 +0200 |
| commit | d964d3b5abb5242591a088dacb1dc01e608b5158 (patch) | |
| tree | 08b3c0492747256db195064e6960cefb1de98f57 /hw/vfio/pci.c | |
| parent | Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ... (diff) | |
| download | qemu-d964d3b5abb5242591a088dacb1dc01e608b5158.tar.gz qemu-d964d3b5abb5242591a088dacb1dc01e608b5158.tar.xz qemu-d964d3b5abb5242591a088dacb1dc01e608b5158.zip | |
hw/vfio/pci: fix double free in vfio_msi_disable
The following guest behaviour patter leads to double free in VFIO PCI:
1. Guest enables MSI interrupts
vfio_msi_enable is called, but fails in vfio_enable_vectors.
In our case this was because VFIO GPU device was in D3 state.
Unhappy path in vfio_msi_enable will g_free(vdev->msi_vectors) but not
set this pointer to NULL
2. Guest still sees MSI an enabled after that because emulated config
write is done in vfio_pci_write_config unconditionally before calling
vfio_msi_enable
3. Guest disables MSI interrupts
vfio_msi_disable is called and tries to g_free(vdev->msi_vectors)
in vfio_msi_disable_common => double free
Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Diffstat (limited to 'hw/vfio/pci.c')
| -rw-r--r-- | hw/vfio/pci.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index c5e6fe61cb..12fac39804 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -651,6 +651,7 @@ retry: } g_free(vdev->msi_vectors); + vdev->msi_vectors = NULL; if (ret > 0 && ret != vdev->nr_vectors) { vdev->nr_vectors = ret; |