Re: [PATCH 1/4] Fix Use-After-Free

["Durrant, Paul" <xadimgnik@xxxxxxxxx>]

On 07/02/2022 13:15, Owen Smith wrote:
> Stash the underlying buffer pointer before freeing the MDL, so that
> MmGetSystemAddressForMdlSafe doesn't attempt to access already-freed
> memory.
>
> Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
Eek. Good spot.

Reviewed-by: Paul Durrant <paul@xxxxxxx>

> ---
>   src/xenbus/fdo.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/src/xenbus/fdo.c b/src/xenbus/fdo.c
> index e2b2702..48d381a 100644
> --- a/src/xenbus/fdo.c
> +++ b/src/xenbus/fdo.c
> @@ -5695,9 +5695,10 @@ __FdoFreeBuffer(
>   
>       Fdo->Mdl = NULL;
>   
> +    Buffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority);
> +
>       ExFreePool(Mdl);
>   
> -    Buffer = MmGetSystemAddressForMdlSafe(Mdl, NormalPagePriority);
>       MmFreeContiguousMemory(Buffer);
>   }
>