diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2016-08-04 14:52:53 +0100 |
|---|---|---|
| committer | Alistair Strachan <astrachan@google.com> | 2019-05-14 17:56:58 -0700 |
| commit | fcee01683f588fa81d4239ca67055bfef9e32211 (patch) | |
| tree | b8d99f326e0c0006797031e9199d96acb9e7f757 /scripts/objdiff | |
| parent | c1763998238e1247aaf085c12a038fbaeab11305 (diff) | |
UPSTREAM: vhost/vsock: fix vhost virtio_vsock_pkt use-after-free
Stash the packet length in a local variable before handing over
ownership of the packet to virtio_transport_recv_pkt() or
virtio_transport_free_pkt().
This patch solves the use-after-free since pkt is no longer guaranteed
to be alive.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 3fda5d6e580193fa005014355b3a61498f1b3ae0)
Bug: 121166534
Test: Ran cuttlefish with android-4.4 + vsock adb tunnel
Signed-off-by: Cody Schuffelen <schuffelen@google.com>
Change-Id: I2a6a8b2eb1b647645ff7c76a37f61dce3b0fab9f
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions