Dan Carpenter e01dfcc08b virtio_ring: Fix two use after free bugs ... [ Upstream commit e152d8af4220a05c9797591609151d404866beaa ] The "vq" struct is added to the "vdev->vqs" list prematurely. If we encounter an error later in the function then the "vq" is freed, but since it is still on the list that could lead to a use after free bug. Fixes: cbeedb72b9 ("virtio_ring: allocate desc state for split ring separately") Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de> Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-12-30 11:51:29 +01:00
..
Kconfig
Makefile
virtio_balloon.c	virtio_balloon: fix up endian-ness for free cmd id	2020-08-05 09:59:43 +02:00
virtio_input.c
virtio_mmio.c
virtio_pci_common.c
virtio_pci_common.h
virtio_pci_legacy.c
virtio_pci_modern.c
virtio_ring.c	virtio_ring: Fix two use after free bugs	2020-12-30 11:51:29 +01:00
virtio.c