[Qemu-devel] [PATCH] virtiofsd: fix req use-after-free in lo_flush()

[Stefan Hajnoczi]

Isn't it funny that a commit trying to fix use-after-free introduced its
own use-after-free?

fuse_reply_err() frees the request so we cannot call lo_data(req)
afterwards.

Fixes: a5081fc6fc3603671383616127b3a5e169cf64ed
       ("virtiofsd: introduce inode refcount to prevent use-after-free")
Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com>
---
 contrib/virtiofsd/passthrough_ll.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/contrib/virtiofsd/passthrough_ll.c 
b/contrib/virtiofsd/passthrough_ll.c
index ee8627446a..a81c01d0d1 100644
--- a/contrib/virtiofsd/passthrough_ll.c
+++ b/contrib/virtiofsd/passthrough_ll.c
@@ -1969,9 +1969,8 @@ static void lo_flush(fuse_req_t req, fuse_ino_t ino, 
struct fuse_file_info *fi)
        pthread_mutex_unlock(&inode->plock_mutex);
 
        res = close(dup(lo_fi_fd(req, fi)));
-       fuse_reply_err(req, res == -1 ? errno : 0);
-
        lo_inode_put(lo_data(req), &inode);
+       fuse_reply_err(req, res == -1 ? errno : 0);
 }
 
 static void lo_fsync(fuse_req_t req, fuse_ino_t ino, int datasync,
-- 
2.21.0