d82d8d21a6
-------------------------------------------------------- * Mon Jul 17 2023 Miroslav Rezanina <mrezanin@redhat.com> - 8.0.0-8 - kvm-virtio-iommu-Fix-64kB-host-page-size-VFIO-device-ass.patch [bz#2211609 bz#2211634] - kvm-virtio-iommu-Rework-the-traces-in-virtio_iommu_set_p.patch [bz#2211609 bz#2211634] - kvm-vfio-pci-add-support-for-VF-token.patch [bz#2192818] - kvm-vfio-migration-Skip-log_sync-during-migration-SETUP-.patch [bz#2192818] - kvm-vfio-pci-Static-Resizable-BAR-capability.patch [bz#2192818] - kvm-vfio-pci-Fix-a-use-after-free-issue.patch [bz#2192818] - kvm-util-vfio-helpers-Use-g_file_read_link.patch [bz#2192818] - kvm-migration-Make-all-functions-check-have-the-same-for.patch [bz#2192818] - kvm-migration-Move-migration_properties-to-options.c.patch [bz#2192818] - kvm-migration-Add-switchover-ack-capability.patch [bz#2192818] - kvm-migration-Implement-switchover-ack-logic.patch [bz#2192818] - kvm-migration-Enable-switchover-ack-capability.patch [bz#2192818] - kvm-vfio-migration-Refactor-vfio_save_block-to-return-sa.patch [bz#2192818] - kvm-vfio-migration-Store-VFIO-migration-flags-in-VFIOMig.patch [bz#2192818] - kvm-vfio-migration-Add-VFIO-migration-pre-copy-support.patch [bz#2192818] - kvm-vfio-migration-Add-support-for-switchover-ack-capabi.patch [bz#2192818] - kvm-vfio-Implement-a-common-device-info-helper.patch [bz#2192818] - kvm-hw-vfio-pci-quirks-Support-alternate-offset-for-GPUD.patch [bz#2192818] - kvm-vfio-pci-Call-vfio_prepare_kvm_msi_virq_batch-in-MSI.patch [bz#2192818] - kvm-vfio-migration-Reset-bytes_transferred-properly.patch [bz#2192818] - kvm-vfio-migration-Make-VFIO-migration-non-experimental.patch [bz#2192818] - kvm-vfio-pci-Fix-a-segfault-in-vfio_realize.patch [bz#2192818] - kvm-vfio-pci-Free-leaked-timer-in-vfio_realize-error-pat.patch [bz#2192818] - kvm-hw-vfio-pci-quirks-Sanitize-capability-pointer.patch [bz#2192818] - kvm-vfio-pci-Disable-INTx-in-vfio_realize-error-path.patch [bz#2192818] - kvm-vfio-migration-Change-vIOMMU-blocker-from-global-to-.patch [bz#2192818] - kvm-vfio-migration-Free-resources-when-vfio_migration_re.patch [bz#2192818] - kvm-vfio-migration-Remove-print-of-Migration-disabled.patch [bz#2192818] - kvm-vfio-migration-Return-bool-type-for-vfio_migration_r.patch [bz#2192818] - kvm-vfio-Fix-null-pointer-dereference-bug-in-vfio_bars_f.patch [bz#2192818] - kvm-pc-bios-s390-ccw-Makefile-Use-z-noexecstack-to-silen.patch [bz#2220866] - kvm-pc-bios-s390-ccw-Fix-indentation-in-start.S.patch [bz#2220866] - kvm-pc-bios-s390-ccw-Provide-space-for-initial-stack-fra.patch [bz#2220866] - kvm-pc-bios-s390-ccw-Don-t-use-__bss_start-with-the-larl.patch [bz#2220866] - kvm-ui-Fix-pixel-colour-channel-order-for-PNG-screenshot.patch [bz#2222579] - kvm-block-blkio-fix-module_block.py-parsing.patch [bz#2213317] - kvm-Fix-virtio-blk-vhost-vdpa-typo-in-spec-file.patch [bz#2213317] - Resolves: bz#2211609 (With virtio-iommu and vfio-pci, qemu reports "warning: virtio-iommu page mask 0xfffffffffffff000 does not match 0x40201000") - Resolves: bz#2211634 ([aarch64] With virtio-iommu and vfio-pci, qemu coredump when host using kernel-64k package) - Resolves: bz#2192818 ([VFIO LM] Live migration) - Resolves: bz#2220866 (Misaligned symbol for s390-ccw image during qemu-kvm build) - Resolves: bz#2222579 (PNG screendump doesn't save screen correctly) - Resolves: bz#2213317 (Enable libblkio-based block drivers in QEMU)
57 lines
2.0 KiB
Diff
57 lines
2.0 KiB
Diff
From 2437a06ff137c4bc856df096e42407c1f50b25b0 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
|
|
Date: Wed, 12 Jul 2023 17:46:56 +0200
|
|
Subject: [PATCH 06/37] vfio/pci: Fix a use-after-free issue
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Cédric Le Goater <clg@redhat.com>
|
|
RH-MergeRequest: 179: vfio: live migration support
|
|
RH-Bugzilla: 2192818
|
|
RH-Acked-by: Eric Auger <eric.auger@redhat.com>
|
|
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
RH-Commit: [4/28] eca69a7e0a6fb8c1c70be8b91209a53b040e30ba (clegoate/qemu-kvm-c9s)
|
|
|
|
Bugzilla: https://bugzilla.redhat.com/2192818
|
|
|
|
commit b83b40b61484
|
|
Author: Zhenzhong Duan <zhenzhong.duan@intel.com>
|
|
Date: Wed May 17 10:46:51 2023 +0800
|
|
|
|
vfio/pci: Fix a use-after-free issue
|
|
|
|
vbasedev->name is freed wrongly which leads to garbage VFIO trace log.
|
|
Fix it by allocating a dup of vbasedev->name and then free the dup.
|
|
|
|
Fixes: 2dca1b37a760 ("vfio/pci: add support for VF token")
|
|
Suggested-by: Alex Williamson <alex.williamson@redhat.com>
|
|
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
|
|
Reviewed-by: Cédric Le Goater <clg@redhat.com>
|
|
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
|
|
Acked-by: Alex Williamson <alex.williamson@redhat.com>
|
|
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
Signed-off-by: Cédric Le Goater <clg@redhat.com>
|
|
|
|
Signed-off-by: Cédric Le Goater <clg@redhat.com>
|
|
---
|
|
hw/vfio/pci.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
|
|
index 6cd3a98c39..7c5e2b5996 100644
|
|
--- a/hw/vfio/pci.c
|
|
+++ b/hw/vfio/pci.c
|
|
@@ -3018,7 +3018,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
|
|
qemu_uuid_unparse(&vdev->vf_token, uuid);
|
|
name = g_strdup_printf("%s vf_token=%s", vbasedev->name, uuid);
|
|
} else {
|
|
- name = vbasedev->name;
|
|
+ name = g_strdup(vbasedev->name);
|
|
}
|
|
|
|
ret = vfio_get_device(group, name, vbasedev, errp);
|
|
--
|
|
2.39.3
|
|
|