Re: [PATCH] vfio: fix use-after-free in display

[Gerd Hoffmann]

  Hi,

> Tricky, but I think I follow that dpy->region.surface is only ever
> allocated to replace dpy->con->surface, so when ramfb_display_update()
> then replaces and frees dpy->con->surface with dpy->ramfb->ds, that's
> where the object point to by dpy->region.surface was freed.  Right?

Correct.

> If so, looks ok to me.  If you're constructing a pull request, I'll
> give you an:
> 
> Acked-by: Alex Williamson <alex.williamson@redhat.com>
> Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
> 
> If you need me to send a pull, let me know.

I'll go create a pull req, I have one or two other patches pending
anyway.

take care,
  Gerd