On 2016年08月08日 21:08, Dmitry Fleytman wrote:
Acked-by: Dmitry Fleytman <dmi...@daynix.com>On 8 Aug 2016, at 15:38 PM, P J P <ppan...@redhat.com> wrote: From: Li Qiang <liqiang...@360.cn> Vmxnet3 device emulator does not check if the device is active, before using it for write. It leads to a use after free issue, if the vmxnet3_io_bar0_write routine is called after the device is deactivated. Add check to avoid it. Reported-by: Li Qiang <liqiang...@360.cn> Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> --- hw/net/vmxnet3.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index bbf44ad..90f6943 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1167,6 +1167,10 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr, { VMXNET3State *s = opaque; + if (!s->device_active) { + return; + } + if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_TXPROD, VMXNET3_DEVICE_MAX_TX_QUEUES, VMXNET3_REG_ALIGN)) { int tx_queue_idx = -- 2.5.5
Applied, thanks.
