Re: [PATCH 1/2] vhost-vdpa: fix use-after-free of v->config_ctx

2021-03-11 Thread Jason Wang
On 2021/3/11 9:52 下午, Stefano Garzarella wrote: When the 'v->config_ctx' eventfd_ctx reference is released we didn't set it to NULL. So if the same character device (e.g. /dev/vhost-vdpa-0) is re-opened, the 'v->config_ctx' is invalid and calling again vhost_vdpa_config_put() causes

Re: [PATCH 1/2] vhost-vdpa: fix use-after-free of v->config_ctx

2021-03-11 Thread Zhu, Lingshan
On 3/11/2021 9:52 PM, Stefano Garzarella wrote: When the 'v->config_ctx' eventfd_ctx reference is released we didn't set it to NULL. So if the same character device (e.g. /dev/vhost-vdpa-0) is re-opened, the 'v->config_ctx' is invalid and calling again vhost_vdpa_config_put() causes

[PATCH 1/2] vhost-vdpa: fix use-after-free of v->config_ctx

2021-03-11 Thread Stefano Garzarella
When the 'v->config_ctx' eventfd_ctx reference is released we didn't set it to NULL. So if the same character device (e.g. /dev/vhost-vdpa-0) is re-opened, the 'v->config_ctx' is invalid and calling again vhost_vdpa_config_put() causes use-after-free issues like the following refcount_t underflow: