From: Evgeny Yakovlev Date: Thu, 10 Oct 2019 17:07:28 +0000 (-0600) Subject: hw/vfio/pci: fix double free in vfio_msi_disable X-Git-Tag: qemu-xen-4.14.0~352^2 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=d964d3b5abb5242591a088dacb1dc01e608b5158;p=qemu-xen.git hw/vfio/pci: fix double free in vfio_msi_disable The following guest behaviour patter leads to double free in VFIO PCI: 1. Guest enables MSI interrupts vfio_msi_enable is called, but fails in vfio_enable_vectors. In our case this was because VFIO GPU device was in D3 state. Unhappy path in vfio_msi_enable will g_free(vdev->msi_vectors) but not set this pointer to NULL 2. Guest still sees MSI an enabled after that because emulated config write is done in vfio_pci_write_config unconditionally before calling vfio_msi_enable 3. Guest disables MSI interrupts vfio_msi_disable is called and tries to g_free(vdev->msi_vectors) in vfio_msi_disable_common => double free Signed-off-by: Evgeny Yakovlev Signed-off-by: Alex Williamson --- diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index c5e6fe61cb..12fac39804 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -651,6 +651,7 @@ retry: } g_free(vdev->msi_vectors); + vdev->msi_vectors = NULL; if (ret > 0 && ret != vdev->nr_vectors) { vdev->nr_vectors = ret;