Re: [PATCH net-XXX] vhost-vdpa: fix use after free in vhost_vdpa_probe()

2023-10-31 Thread Michael S. Tsirkin
On Fri, Oct 27, 2023 at 03:12:54PM +0300, Dan Carpenter wrote: > The put_device() calls vhost_vdpa_release_dev() which calls > ida_simple_remove() and frees "v". So this call to > ida_simple_remove() is a use after free and a double free. > > Fixes: ebe6a354fa7e ("vhost-vdpa: Call ida_simple_remo

Re: [PATCH net-XXX] vhost-vdpa: fix use after free in vhost_vdpa_probe()

2023-10-31 Thread Jason Wang
On Fri, Oct 27, 2023 at 8:13 PM Dan Carpenter wrote: > > The put_device() calls vhost_vdpa_release_dev() which calls > ida_simple_remove() and frees "v". So this call to > ida_simple_remove() is a use after free and a double free. > > Fixes: ebe6a354fa7e ("vhost-vdpa: Call ida_simple_remove() whe