)]}'
{
  "commit": "031b1abacbdb3f4e016b6b926f7e7876c05339bb",
  "tree": "82551e443e943de71dc37a15d7d9a28499515128",
  "parents": [
    "625b370c45f4acd155ee625d61c0057d770a5b5e"
  ],
  "author": {
    "name": "Hawkins Jiawei",
    "email": "yin31149@gmail.com",
    "time": "Sat Jul 08 00:44:42 2023 +0800"
  },
  "committer": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Mon Jul 10 18:59:32 2023 -0400"
  },
  "message": "vdpa: Fix possible use-after-free for VirtQueueElement\n\nQEMU uses vhost_handle_guest_kick() to forward guest\u0027s available\nbuffers to the vdpa device in SVQ avail ring.\n\nIn vhost_handle_guest_kick(), a `g_autofree` `elem` is used to\niterate through the available VirtQueueElements. This `elem` is\nthen passed to `svq-\u003eops-\u003eavail_handler`, specifically to the\nvhost_vdpa_net_handle_ctrl_avail(). If this handler fails to\nprocess the CVQ command, vhost_handle_guest_kick() regains\nownership of the `elem`, and either frees it or requeues it.\n\nYet the problem is that, vhost_vdpa_net_handle_ctrl_avail()\nmistakenly frees the `elem`, even if it fails to forward the\nCVQ command to vdpa device. This can result in a use-after-free\nfor the `elem` in vhost_handle_guest_kick().\n\nThis patch solves this problem by refactoring\nvhost_vdpa_net_handle_ctrl_avail() to only freeing the `elem` if\nit owns it.\n\nFixes: bd907ae4b0 (\"vdpa: manual forward CVQ buffers\")\nSigned-off-by: Hawkins Jiawei \u003cyin31149@gmail.com\u003e\nMessage-Id: \u003ce3f2d7db477734afe5c6a5ab3fa8b8317514ea34.1688746840.git.yin31149@gmail.com\u003e\nReviewed-by: Eugenio Pérez \u003ceperezma@redhat.com\u003e\nReviewed-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "679ef4bed0c6716c3d72505ef7e560a83239f643",
      "old_mode": 33188,
      "old_path": "net/vhost-vdpa.c",
      "new_id": "5542b47a8fc0c456c51099d6d63e3c07b328592e",
      "new_mode": 33188,
      "new_path": "net/vhost-vdpa.c"
    }
  ]
}