aboutsummaryrefslogtreecommitdiff
path: root/hw/vexpress.c
diff options
context:
space:
mode:
authorStefan Hajnoczi <stefanha@linux.vnet.ibm.com>2011-09-30 11:39:11 +0100
committerAnthony Liguori <aliguori@us.ibm.com>2011-10-05 10:52:31 -0500
commite4fc8781db7c49b0c5ac5d24762e17c59dfe0871 (patch)
tree4ba5d1094292e2456e5299ad42674b7f56cfac83 /hw/vexpress.c
parentd11cf8cc80d946dfc9a23597cd9a0bb1c487cfa7 (diff)
qed: fix use-after-free during l2 cache commit
QED's metadata caching strategy allows two parallel requests to race for metadata lookup. The first one to complete will populate the metadata cache and the second one will drop the data it just read in favor of the cached data. There is a use-after-free in qed_read_l2_table_cb() and qed_commit_l2_update() where l2_table->offset was used after the l2_table may have been freed due to a metadata lookup race. Fix this by keeping the l2_offset in a local variable and not reaching into the possibly freed l2_table. Reported-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'hw/vexpress.c')
0 files changed, 0 insertions, 0 deletions