vhost-net: fix use-after-free in vhost_net_flush (dd7633ec) · Commits · 戴 / test

vhost_net_ubuf_put_and_wait has a confusing name: it will actually also free it's argument. Thus since commit "vhost-net: flush outstanding DMAs on memory change" vhost_net_flush tries to use the argument after passing it to vhost_net_ubuf_put_and_wait, this results in use after free. To fix, don't free the argument in vhost_net_ubuf_put_and_wait, add an new API for callers that want to free ubufs. Acked-by:

Asias He <asias@redhat.com> Acked-by:

Jason Wang <jasowang@redhat.com> Signed-off-by:

Michael S. Tsirkin <mst@redhat.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/vhost/net.c

+7 −2

Original line number	Diff line number	Diff line
		@@ -150,6 +150,11 @@ static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs)
		{
		kref_put(&ubufs->kref, vhost_net_zerocopy_done_signal);
		wait_event(ubufs->wait, !atomic_read(&ubufs->kref.refcount));
		}

		static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs)
		{
		vhost_net_ubuf_put_and_wait(ubufs);
		kfree(ubufs);
		}

		@@ -948,7 +953,7 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
		mutex_unlock(&vq->mutex);

		if (oldubufs) {
		vhost_net_ubuf_put_and_wait(oldubufs);
		vhost_net_ubuf_put_wait_and_free(oldubufs);
		mutex_lock(&vq->mutex);
		vhost_zerocopy_signal_used(n, vq);
		mutex_unlock(&vq->mutex);
		@@ -966,7 +971,7 @@ err_used:
		rcu_assign_pointer(vq->private_data, oldsock);
		vhost_net_enable_vq(n, vq);
		if (ubufs)
		vhost_net_ubuf_put_and_wait(ubufs);
		vhost_net_ubuf_put_wait_and_free(ubufs);
		err_ubufs:
		fput(sock->file);
		err_vq:

Admin message