From patchwork Mon Oct 7 18:30:23 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Michael S. Tsirkin" X-Patchwork-Id: 11178305 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 84AB8139A for ; Mon, 7 Oct 2019 18:30:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6D20A21721 for ; Mon, 7 Oct 2019 18:30:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729501AbfJGSab (ORCPT ); Mon, 7 Oct 2019 14:30:31 -0400 Received: from mx1.redhat.com ([209.132.183.28]:59548 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729495AbfJGSaa (ORCPT ); Mon, 7 Oct 2019 14:30:30 -0400 Received: from mail-qt1-f197.google.com (mail-qt1-f197.google.com [209.85.160.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 9325F3CA1E for ; Mon, 7 Oct 2019 18:30:30 +0000 (UTC) Received: by mail-qt1-f197.google.com with SMTP id c8so16196222qtd.20 for ; Mon, 07 Oct 2019 11:30:30 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=Veqvl+qM0CfutM3PPjJjEy4hKVrp4NP3ezEQkZHIQPg=; b=qLOKFka1JgGhHV8PinCIX6TEuQunPcfjmiCoqSclrk2iFLvTOsidLDev5wWsvDTXfe zMWEJEOpJyROOkj8ckjwV9sRO2wDfL62QB6D4BmeKf3SIuiDeB5SqsNuMV3b70+fmzBh 6R6NqTnIBPuuCzmcNveXLO9DnGUTkVUM5EAxLVjlyGCaC7z2zaxWJArsOMx+sMugMSJz bCLVZ5vn8jMoBd0IFEWClaZncTYRUCij1/nqL+0fdumeHeX0lxc++MmS5PHkrWI5V0Sd Veq0pFTpjY3nVNlaAINfNzs0a2NRZLlF9lohg3Rpt4cabYvrZwlwSR2wggm80Et4pic5 nstg== X-Gm-Message-State: APjAAAWB8bnjtJTb0XTlW9j17d/6sDHEcr69/kN5mKed7lTyZ51raVLn 8c1R9OiZ57nSAVw1hWkBQM1c/yzNrgDlEel49YPGR9mHcDtyjuhBW/6cG0IdVotnc1SBH74TTvS ytksdBb9TCofC X-Received: by 2002:a37:8f86:: with SMTP id r128mr14609058qkd.392.1570473029368; Mon, 07 Oct 2019 11:30:29 -0700 (PDT) X-Google-Smtp-Source: APXvYqx5hMQXVRiXUEyBzpDI1RwgrB4b7tr07l8zU3XqKSSML03JT2g+x+mug176n0y6vIeLAWA/TQ== X-Received: by 2002:a37:8f86:: with SMTP id r128mr14609014qkd.392.1570473029025; Mon, 07 Oct 2019 11:30:29 -0700 (PDT) Received: from redhat.com (bzq-79-176-10-77.red.bezeqint.net. [79.176.10.77]) by smtp.gmail.com with ESMTPSA id s50sm9515361qth.92.2019.10.07.11.30.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 07 Oct 2019 11:30:28 -0700 (PDT) Date: Mon, 7 Oct 2019 14:30:23 -0400 From: "Michael S. Tsirkin" To: linux-kernel@vger.kernel.org Cc: Jason Wang , kvm@vger.kernel.org, virtualization@lists.linux-foundation.org, netdev@vger.kernel.org Subject: [PATCH] vhost/test: stop device before reset Message-ID: <20191007183019.12522-1-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email 2.22.0.678.g13338e74b8 X-Mutt-Fcc: =sent Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org When device stop was moved out of reset, test device wasn't updated to stop before reset, this resulted in a use after free. Fix by invoking stop appropriately. Fixes: b211616d7125 ("vhost: move -net specific code out") Signed-off-by: Michael S. Tsirkin --- drivers/vhost/test.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c index 04edd8db62fc..e3a8e9db22cd 100644 --- a/drivers/vhost/test.c +++ b/drivers/vhost/test.c @@ -170,6 +170,7 @@ static int vhost_test_release(struct inode *inode, struct file *f) vhost_test_stop(n, &private); vhost_test_flush(n); + vhost_dev_stop(&n->dev); vhost_dev_cleanup(&n->dev); /* We do an extra flush before freeing memory, * since jobs can re-queue themselves. */ @@ -246,6 +247,7 @@ static long vhost_test_reset_owner(struct vhost_test *n) } vhost_test_stop(n, &priv); vhost_test_flush(n); + vhost_dev_stop(&n->dev); vhost_dev_reset_owner(&n->dev, umem); done: mutex_unlock(&n->dev.mutex);