linux

mirror of https://github.com/raspberrypi/linux.git synced 2025-12-28 04:52:52 +00:00

Files

Dan Carpenter dbdfefc71a virtio_ring: Fix two use after free bugs

[ Upstream commit e152d8af42 ]

The "vq" struct is added to the "vdev->vqs" list prematurely.  If we
encounter an error later in the function then the "vq" is freed, but
since it is still on the list that could lead to a use after free bug.

Fixes: cbeedb72b9 ("virtio_ring: allocate desc state for split ring separately")
Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2020-12-30 11:54:00 +01:00

Kconfig

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

2020-10-23 11:00:57 -07:00

Makefile

virtio: fix build for configs without dma-bufs

2020-08-19 06:43:28 +02:00

virtio_balloon.c

virtio-balloon: Constify id_table

2020-10-21 10:34:08 -04:00

virtio_dma_buf.c

virtio: fix build for configs without dma-bufs