]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7f7f8a3) | patch
vhost/vsock: fix vhost virtio_vsock_pkt use-after-free
authorStefan Hajnoczi <stefanha@redhat.com>
Thu, 4 Aug 2016 13:52:53 +0000 (14:52 +0100)
committerMichael S. Tsirkin <mst@redhat.com>
Tue, 9 Aug 2016 10:42:37 +0000 (13:42 +0300)
commit54f3b815f8af1f5e442fc9a1a87d8ab164688a9a
tree351ecd0bebf5e2e863ad233fe356cf54a08d9ce3tree | snapshot
parent7f7f8a31d064a68c66bc35b97e46ce7f7d1ab8b2commit | diff
vhost/vsock: fix vhost virtio_vsock_pkt use-after-free

Stash the packet length in a local variable before handing over
ownership of the packet to virtio_transport_recv_pkt() or
virtio_transport_free_pkt().

This patch solves the use-after-free since pkt is no longer guaranteed
to be alive.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
drivers/vhost/vsock.c diff | blob | history
Linux Kernel Source Tree.