diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2016-08-04 14:52:53 +0100 |
|---|---|---|
| committer | Alistair Strachan <astrachan@google.com> | 2019-01-15 17:08:36 -0800 |
| commit | 613ffe183896c82b2d065efc39192686c25110bb (patch) | |
| tree | bf1edaecef761d1f73171e72cb5846b44c8017c1 /include/linux/debugobjects.h | |
| parent | b09cc234f36b1c1b26a20ef32ae6da817bd63ed6 (diff) | |
UPSTREAM: vhost/vsock: fix vhost virtio_vsock_pkt use-after-free
Stash the packet length in a local variable before handing over
ownership of the packet to virtio_transport_recv_pkt() or
virtio_transport_free_pkt().
This patch solves the use-after-free since pkt is no longer guaranteed
to be alive.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 3fda5d6e580193fa005014355b3a61498f1b3ae0)
Bug: 121166534
Test: Ran cuttlefish with android-4.4 + vsock adb tunnel
Signed-off-by: Cody Schuffelen <schuffelen@google.com>
Change-Id: I2a6a8b2eb1b647645ff7c76a37f61dce3b0fab9f
Diffstat (limited to 'include/linux/debugobjects.h')
0 files changed, 0 insertions, 0 deletions