Messages in this thread | | | Date | Thu, 25 Feb 2021 14:54:40 -0500 | From | Peter Xu <> | Subject | Re: [RFC PATCH 10/10] vfio/type1: Register device notifier |
| |
On Thu, Feb 25, 2021 at 03:17:14PM -0400, Jason Gunthorpe wrote: > It is a use-after-free. Once the PFN is programmed into the IOMMU it > becomes completely divorced from the VMA. Remember there is no > pin_user_page here, so the PFN has no reference count. > > If the owner of the VMA decided to zap it or otherwise then the IOMMU > access keeps going - but now the owner thinks the PFN is free'd and > nobody is referencing it. Goes bad.
Sounds reasonable. Thanks,
-- Peter Xu
| |