vhost: fix double free on device stop

PATCH In review Michael S. Tsirkin 3 participants 3 messages Jun 21, 2011 – Jun 22, 2011

Share & tools

Michael S. Tsirkin

author

2011-06-21 17:34 UTC #0 lore raw

PATCH v2 1/1 vhost: fix double free on device stop

vhost dev stop failed to clear the log field. Typically not an issue as dev start overwrites this field, but if logging gets disabled before the following start, it doesn't so this causes a double free.

Signed-off-by Michael S. Tsirkin <[email protected]>

---
 hw/vhost.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

hw/vhost.c +1 -0

index 80f771e..c3d8821 100644
@@ -784,5 +784,6 @@ void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev)
 
     hdev->started = false;
     qemu_free(hdev->log);
+    hdev->log = NULL;
     hdev->log_size = 0;
 }

Signature · 1 line

1.7.5.53.gc233e

Chris Wright

Acked-by on v2 1/1

2011-06-21 17:49 UTC #1 lore raw

Quoted 6 lines · * Michael S. Tsirkin ([email protected]) wrote:

vhost dev stop failed to clear the log field. Typically not an issue as dev start overwrites this field, but if logging gets disabled before the following start, it doesn't so this causes a double free.
Signed-off-by Michael S. Tsirkin <[email protected]>

Acked-by Chris Wright <[email protected]>

thanks,
-chris

Jason Wang

Acked-by on v2 1/1

2011-06-22 03:03 UTC #2 lore raw

In reply to Michael S. Tsirkin

Quoted 7 lines · Michael S. Tsirkin

vhost dev stop failed to clear the log field. Typically not an issue as dev start overwrites this field, but if logging gets disabled before the following start, it doesn't so this causes a double free.
Signed-off-by Michael S. Tsirkin<[email protected]>
---

Acked-by Jason Wang <[email protected]>

Quoted 14 lines

  hw/vhost.c |    1 +
  1 files changed, 1 insertions(+), 0 deletions(-)

hw/vhost.c +1 -0

index 80f771e..c3d8821 100644
@@ -784,5 +784,6 @@ void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev)
 
      hdev->started = false;
      qemu_free(hdev->log);
+    hdev->log = NULL;
      hdev->log_size = 0;
  }