diff options
| author | Stefan Hajnoczi <[email protected]> | 2016-08-04 13:52:53 +0000 |
|---|---|---|
| committer | Michael S. Tsirkin <[email protected]> | 2016-08-09 10:42:37 +0000 |
| commit | 3fda5d6e580193fa005014355b3a61498f1b3ae0 (patch) | |
| tree | 351ecd0bebf5e2e863ad233fe356cf54a08d9ce3 /drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | |
| parent | 9p/trans_virtio: use kvfree() for iov_iter_get_pages_alloc() (diff) | |
| download | kernel-3fda5d6e580193fa005014355b3a61498f1b3ae0.tar.gz kernel-3fda5d6e580193fa005014355b3a61498f1b3ae0.zip | |
vhost/vsock: fix vhost virtio_vsock_pkt use-after-free
Stash the packet length in a local variable before handing over
ownership of the packet to virtio_transport_recv_pkt() or
virtio_transport_free_pkt().
This patch solves the use-after-free since pkt is no longer guaranteed
to be alive.
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Stefan Hajnoczi <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c')
0 files changed, 0 insertions, 0 deletions