Google Git
Sign in
qemu / qemu / e4fc8781db7c49b0c5ac5d24762e17c59dfe0871
commite4fc8781db7c49b0c5ac5d24762e17c59dfe0871[log] [tgz]
authorStefan Hajnoczi <stefanha@linux.vnet.ibm.com>Fri Sep 30 11:39:11 2011 +0100
committerAnthony Liguori <aliguori@us.ibm.com>Wed Oct 05 10:52:31 2011 -0500
tree4ba5d1094292e2456e5299ad42674b7f56cfac83
parentd11cf8cc80d946dfc9a23597cd9a0bb1c487cfa7 [diff]
qed: fix use-after-free during l2 cache commit

QED's metadata caching strategy allows two parallel requests to race for
metadata lookup.  The first one to complete will populate the metadata
cache and the second one will drop the data it just read in favor of the
cached data.

There is a use-after-free in qed_read_l2_table_cb() and
qed_commit_l2_update() where l2_table->offset was used after the
l2_table may have been freed due to a metadata lookup race.  Fix this by
keeping the l2_offset in a local variable and not reaching into the
possibly freed l2_table.

Reported-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2 files changed
tree: 4ba5d1094292e2456e5299ad42674b7f56cfac83
  1. audio/
  2. block/
  3. bsd-user/
  4. darwin-user/
  5. default-configs/
  6. docs/
  7. fpu/
  8. fsdev/
  9. gdb-xml/
  10. hw/
  11. libcacard/
  12. linux-headers/
  13. linux-user/
  14. net/
  15. pc-bios/
  16. qapi/
  17. qga/
  18. QMP/
  19. roms/
  20. scripts/
  21. slirp/
  22. sysconfigs/
  23. target-alpha/
  24. target-arm/
  25. target-cris/
  26. target-i386/
  27. target-lm32/
  28. target-m68k/
  29. target-microblaze/
  30. target-mips/
  31. target-ppc/
  32. target-s390x/
  33. target-sh4/
  34. target-sparc/
  35. target-unicore32/
  36. target-xtensa/
  37. tcg/
  38. tests/
  39. trace/
  40. ui/
  41. .gitignore
  42. .gitmodules
  43. a.out.h
  44. acl.c
  45. acl.h
  46. aes.c
  47. aes.h
  48. aio.c
  49. alpha-dis.c
  50. alpha.ld
  51. arch_init.c
  52. arch_init.h
  53. arm-dis.c
  54. arm-semi.c
  55. arm.ld
  56. async.c
  57. balloon.c
  58. balloon.h
  59. bitmap.c
  60. bitmap.h
  61. bitops.c
  62. bitops.h
  63. block-migration.c
  64. block-migration.h
  65. block.c
  66. block.h
  67. block_int.h
  68. blockdev.c
  69. blockdev.h
  70. bswap.h
  71. bt-host.c
  72. bt-host.h
  73. bt-vhci.c
  74. buffered_file.c
  75. buffered_file.h
  76. cache-utils.c
  77. cache-utils.h
  78. Changelog
  79. check-qdict.c
  80. check-qfloat.c
  81. check-qint.c
  82. check-qjson.c
  83. check-qlist.c
  84. check-qstring.c
  85. cmd.c
  86. cmd.h
  87. CODING_STYLE
  88. compatfd.c
  89. compatfd.h
  90. compiler.h
  91. config.h
  92. configure
  93. console.c
  94. console.h
  95. COPYING
  96. COPYING.LIB
  97. coroutine-gthread.c
  98. coroutine-ucontext.c
  99. coroutine-win32.c
  100. cpu-all.h
  101. cpu-common.h
  102. cpu-defs.h
  103. cpu-exec.c
  104. cpus.c
  105. cpus.h
  106. cris-dis.c
  107. cursor.c
  108. cursor_hidden.xpm
  109. cursor_left_ptr.xpm
  110. cutils.c
  111. def-helper.h
  112. device_tree.c
  113. device_tree.h
  114. dis-asm.h
  115. disas.c
  116. disas.h
  117. dma-helpers.c
  118. dma.h
  119. dyngen-exec.h
  120. elf.h
  121. envlist.c
  122. envlist.h
  123. error.c
  124. error.h
  125. error_int.h
  126. exec-all.h
  127. exec-memory.h
  128. exec.c
  129. gdbstub.c
  130. gdbstub.h
  131. gen-icount.h
  132. HACKING
  133. hmp-commands.hx
  134. host-utils.c
  135. host-utils.h
  136. hpet.h
  137. hppa-dis.c
  138. hppa.ld
  139. i386-dis.c
  140. i386.ld
  141. ia64-dis.c
  142. ia64.ld
  143. input.c
  144. iohandler.c
  145. ioport-user.c
  146. ioport.c
  147. ioport.h
  148. iorange.h
  149. iov.c
  150. iov.h
  151. json-lexer.c
  152. json-lexer.h
  153. json-parser.c
  154. json-parser.h
  155. json-streamer.c
  156. json-streamer.h
  157. kvm-all.c
  158. kvm-stub.c
  159. kvm.h
  160. libfdt_env.h
  161. LICENSE
  162. linux-aio.c
  163. m68k-dis.c
  164. m68k-semi.c
  165. m68k.ld
  166. MAINTAINERS
  167. Makefile
  168. Makefile.dis
  169. Makefile.hw
  170. Makefile.objs
  171. Makefile.target
  172. Makefile.user
  173. memory.c
  174. memory.h
  175. microblaze-dis.c
  176. migration-exec.c
  177. migration-fd.c
  178. migration-tcp.c
  179. migration-unix.c
  180. migration.c
  181. migration.h
  182. mips-dis.c
  183. mips.ld
  184. module.c
  185. module.h
  186. monitor.c
  187. monitor.h
  188. nbd.c
  189. nbd.h
  190. net.c
  191. net.h
  192. notify.c
  193. notify.h
  194. os-posix.c
  195. os-win32.c
  196. osdep.c
  197. osdep.h
  198. oslib-posix.c
  199. oslib-win32.c
  200. path.c
  201. pci-ids.txt
  202. pflib.c
  203. pflib.h
  204. poison.h
  205. posix-aio-compat.c
  206. ppc-dis.c
  207. ppc.ld
  208. ppc64.ld
  209. qapi-schema-guest.json
  210. qapi-schema-test.json
  211. qbool.c
  212. qbool.h
  213. qdict-test-data.txt
  214. qdict.c
  215. qdict.h
  216. qemu-aio.h
  217. qemu-barrier.h
  218. qemu-char.c
  219. qemu-char.h
  220. qemu-common.h
  221. qemu-config.c
  222. qemu-config.h
  223. qemu-coroutine-int.h
  224. qemu-coroutine-lock.c
  225. qemu-coroutine.c
  226. qemu-coroutine.h
  227. qemu-doc.texi
  228. qemu-error.c
  229. qemu-error.h
  230. qemu-ga.c
  231. qemu-img-cmds.hx
  232. qemu-img.c
  233. qemu-img.texi
  234. qemu-io.c
  235. qemu-lock.h
  236. qemu-log.h
  237. qemu-nbd.c
  238. qemu-nbd.texi
  239. qemu-objects.h
  240. qemu-option.c
  241. qemu-option.h
  242. qemu-options.h
  243. qemu-options.hx
  244. qemu-os-posix.h
  245. qemu-os-win32.h
  246. qemu-progress.c
  247. qemu-queue.h
  248. qemu-sockets.c
  249. qemu-tech.texi
  250. qemu-thread-posix.c
  251. qemu-thread-posix.h
  252. qemu-thread-win32.c
  253. qemu-thread-win32.h
  254. qemu-thread.h
  255. qemu-timer-common.c
  256. qemu-timer.c
  257. qemu-timer.h
  258. qemu-tool.c
  259. qemu-x509.h
  260. qemu.sasl
  261. qemu_socket.h
  262. qerror.c
  263. qerror.h
  264. qfloat.c
  265. qfloat.h
  266. qint.c
  267. qint.h
  268. qjson.c
  269. qjson.h
  270. qlist.c
  271. qlist.h
  272. qmp-commands.hx
  273. qobject.h
  274. qstring.c
  275. qstring.h
  276. range.h
  277. readline.c
  278. readline.h
  279. README
  280. rules.mak
  281. s390-dis.c
  282. s390.ld
  283. savevm.c
  284. sh4-dis.c
  285. softmmu-semi.h
  286. softmmu_defs.h
  287. softmmu_exec.h
  288. softmmu_header.h
  289. softmmu_template.h
  290. sparc-dis.c
  291. sparc.ld
  292. sparc64.ld
  293. spice-qemu-char.c
  294. sysemu.h
  295. targphys.h
  296. tcg-runtime.c
  297. test-coroutine.c
  298. test-qmp-commands.c
  299. test-visitor.c
  300. thunk.c
  301. thunk.h
  302. TODO
  303. trace-events
  304. translate-all.c
  305. uboot_image.h
  306. usb-bsd.c
  307. usb-linux.c
  308. usb-redir.c
  309. usb-stub.c
  310. user-exec.c
  311. VERSION
  312. version.rc
  313. vgafont.h
  314. vl.c
  315. x86_64.ld
  316. xen-all.c
  317. xen-mapcache.c
  318. xen-mapcache.h
  319. xen-stub.c
  320. xtensa-semi.c