Messages in this thread | | | Date | Mon, 16 Apr 2012 16:28:41 +0300 | From | "Michael S. Tsirkin" <> | Subject | Re: [PATCH 5/6] vhost_net: fix use after free of vq->ubufs |
| |
On Mon, Apr 16, 2012 at 02:08:25PM +0800, Jason Wang wrote: > When zerocopy socket is used, ubufs pointer were used in handle_tx() > without any validation. This would cause NULL pointer deference after > it has been freed in vhost_net_set_backend(). Fix this by check the > pointer before using it. > > Signed-off-by: Jason Wang <jasowang@redhat.com>
OK so it's NULL dereference and not user after free :) Also could you clarify how does this happen pls? Don't we always initialize ubufs when vhost_sock_zcopy is set?
> --- > drivers/vhost/net.c | 7 ++++++- > 1 files changed, 6 insertions(+), 1 deletions(-) > > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c > index f0da2c3..29abd65 100644 > --- a/drivers/vhost/net.c > +++ b/drivers/vhost/net.c > @@ -163,10 +163,15 @@ static void handle_tx(struct vhost_net *net) > mutex_lock(&vq->mutex); > vhost_disable_notify(&net->dev, vq); > > + zcopy = vhost_sock_zcopy(sock); > + if (zcopy && !vq->ubufs) { > + mutex_unlock(&vq->mutex); > + return; > + } > + > if (wmem < sock->sk->sk_sndbuf / 2) > tx_poll_stop(net); > hdr_size = vq->vhost_hlen; > - zcopy = vhost_sock_zcopy(sock); > > for (;;) { > /* Release DMAs done buffers first */
| |