[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit
From: |
Stefan Hajnoczi |
Subject: |
Re: [Qemu-devel] [PATCH] qed: fix use-after-free during l2 cache commit |
Date: |
Wed, 12 Oct 2011 08:53:45 +0100 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
On Tue, Oct 11, 2011 at 04:22:11PM +0200, Kevin Wolf wrote:
> Am 30.09.2011 17:49, schrieb Amit Shah:
> > On (Fri) 30 Sep 2011 [16:23:30], Stefan Hajnoczi wrote:
> >> On Fri, Sep 30, 2011 at 12:27 PM, Amit Shah <address@hidden> wrote:
> >>> On (Fri) 30 Sep 2011 [11:39:11], Stefan Hajnoczi wrote:
> >>>> QED's metadata caching strategy allows two parallel requests to race for
> >>>> metadata lookup. The first one to complete will populate the metadata
> >>>> cache and the second one will drop the data it just read in favor of the
> >>>> cached data.
> >>>>
> >>>> There is a use-after-free in qed_read_l2_table_cb() and
> >>>> qed_commit_l2_update() where l2_table->offset was used after the
> >>>> l2_table may have been freed due to a metadata lookup race. Fix this by
> >>>> keeping the l2_offset in a local variable and not reaching into the
> >>>> possibly freed l2_table.
> >>>>
> >>>> Reported-by: Amit Shah <address@hidden>
> >>>> Signed-off-by: Stefan Hajnoczi <address@hidden>
> >>>> ---
> >>>> Hi Amit,
> >>>> Thanks for reporting the assertion failure you saw at
> >>>> http://fpaste.org/CDuv/.
> >>>> Does this patch fix the problem?
> >>>
> >>> Yes, this fixes it.
> >>
> >> Were you able to reliably reproduce the assertion failure before?
> >
> > Absolutely.
> >
> > I even reverted the patch and tried the same image; same segfault
> > again.
> >
> >> I wonder because this only happens when two metadata lookups race
> >> (which is rare enough on my setup that I've never seen this failure).
> >> It might be worth trying a few times.
> >
> > Get the F16 beta-rc LXE live iso, install guest. It doesn't cleanly
> > reboot, you have to kill the VM. Next start of the VM produces this
> > segfault.
> >
> > https://alt.fedoraproject.org/pub/alt/stage/16-Beta.RC2/Live/x86_64/Fedora-16-Beta-x86_64-Live-LXDE.iso
>
> Can we try to artificially produce it in a qemu-iotests case?
I will take a look.
Stefan