mirror of
https://github.com/qemu/qemu.git
synced 2024-12-12 05:03:42 +08:00
d964d3b5ab
The following guest behaviour patter leads to double free in VFIO PCI: 1. Guest enables MSI interrupts vfio_msi_enable is called, but fails in vfio_enable_vectors. In our case this was because VFIO GPU device was in D3 state. Unhappy path in vfio_msi_enable will g_free(vdev->msi_vectors) but not set this pointer to NULL 2. Guest still sees MSI an enabled after that because emulated config write is done in vfio_pci_write_config unconditionally before calling vfio_msi_enable 3. Guest disables MSI interrupts vfio_msi_disable is called and tries to g_free(vdev->msi_vectors) in vfio_msi_disable_common => double free Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru> Signed-off-by: Alex Williamson <alex.williamson@redhat.com> |
||
|---|---|---|
| .. | ||
| amd-xgbe.c | ||
| ap.c | ||
| calxeda-xgmac.c | ||
| ccw.c | ||
| common.c | ||
| display.c | ||
| Kconfig | ||
| Makefile.objs | ||
| pci-quirks.c | ||
| pci.c | ||
| pci.h | ||
| platform.c | ||
| spapr.c | ||
| trace-events | ||