[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] Use after free problem somewhere in ahci.c or ich.c cod
From: |
John Snow |
Subject: |
Re: [Qemu-devel] Use after free problem somewhere in ahci.c or ich.c code |
Date: |
Tue, 22 Aug 2017 18:25:04 -0400 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 |
On 08/22/2017 05:02 PM, Philippe Mathieu-Daudé wrote:
> On 08/22/2017 03:39 PM, John Snow wrote:
>> On 08/22/2017 02:15 PM, Thomas Huth wrote:
>>>
>>> Looks like there is a use-after-free problem somewhere in
>>> the ahci.c or ich.c code when trying to add the ich9-ahci
>>> on a old PC machine. Using valgrind, I get:
>>>
>
> those old PC don't support AHCI hotplug, so realize() fails then
> unparent() is called.
>
>> I'll look; it looks like it works okay for pc-i440fx-2.9 as well as 2.0
>> and 1.7.
>>
>> 1.6 appears to be the most modern board that has issues, as well as 1.4
>> and the pc-1.2 board you specify.
>
> commit 9e047b982452 "piix4: add acpi pci hotplug support"
>
> "Add support for acpi pci hotplug using the new infrastructure.
> PIIX4 legacy interface is maintained as is for machine types 1.7 and
> older."
>
> I see piix4_pm_init() disabling use_acpi_pci_hotplug if xen_enabled(),
> later when piix4_device_plug_cb() is called for TYPE_PCI_DEVICE it
> checks xen_enabled() instead of checking use_acpi_pci_hotplug.
> Same happens in piix4_device_unplug_request_cb(), not sure it can be
> reached although.
>
> My guess is changing !xen_enabled() -> s->use_acpi_pci_hotplug fixes
> this issue, but I'm not sure this is the safest way to fix it.
>
> I'll send a patch.
>
> Regards,
>
> Phil.
Beat me to it! I'll review, thanks.