Re: [PATCH] hw/vfio/pci: fix double free in vfio_msi_disable

[Alex Williamson]

On Thu, 26 Sep 2019 14:29:35 +0300
Evgeny Yakovlev <address@hidden> wrote:

> The following guest behaviour patter leads to double free in VFIO PCI:
> 
> 1. Guest enables MSI interrupts
> vfio_msi_enable is called, but fails in vfio_enable_vectors.
> In our case this was because VFIO GPU device was in D3 state.
> Unhappy path in vfio_msi_enable will g_free(vdev->msi_vectors) but not
> set this pointer to NULL
> 
> 2. Guest still sees MSI an enabled after that because emulated config
> write is done in vfio_pci_write_config unconditionally before calling
> vfio_msi_enable
> 
> 3. Guest disables MSI interrupts
> vfio_msi_disable is called and tries to g_free(vdev->msi_vectors)
> in vfio_msi_disable_common => double free
> 
> Signed-off-by: Evgeny Yakovlev <address@hidden>
> ---
>  hw/vfio/pci.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
> index c5e6fe6..12fac39 100644
> --- a/hw/vfio/pci.c
> +++ b/hw/vfio/pci.c
> @@ -651,6 +651,7 @@ retry:
>          }
>  
>          g_free(vdev->msi_vectors);
> +        vdev->msi_vectors = NULL;
>  
>          if (ret > 0 && ret != vdev->nr_vectors) {
>              vdev->nr_vectors = ret;

Looks correct to me, I'll queue it.  Thanks,

Alex