diff options
| author | Dan Carpenter | 2020-12-04 17:23:36 +0300 |
|---|---|---|
| committer | Michael S. Tsirkin | 2020-12-18 16:14:31 -0500 |
| commit | e152d8af4220a05c9797591609151d404866beaa (patch) | |
| tree | 743cd19be076a1bd787c3202dd611e86553843e9 /drivers/vhost/scsi.c | |
| parent | 411ea23a76526e6efed0b601abb603d3c981b333 (diff) | |
virtio_ring: Fix two use after free bugs
The "vq" struct is added to the "vdev->vqs" list prematurely. If we
encounter an error later in the function then the "vq" is freed, but
since it is still on the list that could lead to a use after free bug.
Fixes: cbeedb72b97a ("virtio_ring: allocate desc state for split ring separately")
Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'drivers/vhost/scsi.c')
0 files changed, 0 insertions, 0 deletions