Re: [PATCH] vfio/pci: Fix a use-after-free issue

[Cédric Le Goater]

On 5/16/23 05:43, Zhenzhong Duan wrote:

We should free the duplicated variant of vbasedev->name plus uuid
rather than vbasedev->name itself.

Fixes: 2dca1b37a7 ("vfio/pci: add support for VF toke")

"toke" -> "token"

Signed-off-by: Zhenzhong Duan <zhenzhong.d...@intel.com>
---
  hw/vfio/pci.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index bf27a3990564..d2593681e000 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2998,7 +2998,9 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
      }

ret = vfio_get_device(group, name, vbasedev, errp);

-    g_free(name);
+    if (name != vbasedev->name) {

yes. I wonder if we shouldn't use the same test with which 'name' was
allocated instead :

    if (!qemu_uuid_is_null(&vdev->vf_token)) {

Thanks,

C.

+        g_free(name);
+    }
      if (ret) {
          vfio_put_group(group);
          goto error;