Dan Carpenter dbdfefc71a virtio_ring: Fix two use after free bugs ... [ Upstream commit e152d8af4220a05c9797591609151d404866beaa ] The "vq" struct is added to the "vdev->vqs" list prematurely. If we encounter an error later in the function then the "vq" is freed, but since it is still on the list that could lead to a use after free bug. Fixes: cbeedb72b9 ("virtio_ring: allocate desc state for split ring separately") Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de> Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-12-30 11:54:00 +01:00
..
Kconfig	vhost,vdpa,virtio: cleanups, fixes	2020-10-23 11:00:57 -07:00
Makefile	virtio: fix build for configs without dma-bufs	2020-08-19 06:43:28 +02:00
virtio_balloon.c	virtio-balloon: Constify id_table	2020-10-21 10:34:08 -04:00
virtio_dma_buf.c	virtio: fix build for configs without dma-bufs	2020-08-19 06:43:28 +02:00
virtio_input.c	virtio_input: Constify id_table	2020-10-21 10:34:09 -04:00
virtio_mem.c	vhost,vdpa,virtio: cleanups, fixes	2020-10-23 11:00:57 -07:00
virtio_mmio.c	virtio: Implement get_shm_region for MMIO transport	2020-09-10 10:05:58 +02:00
virtio_pci_common.c	virtio-pci: check name when counting MSI-X vectors	2020-02-06 03:40:26 -05:00
virtio_pci_common.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 78	2019-05-24 17:37:51 +02:00
virtio_pci_legacy.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 78	2019-05-24 17:37:51 +02:00
virtio_pci_modern.c	virtio: Implement get_shm_region for PCI transport	2020-09-10 10:05:58 +02:00
virtio_ring.c	virtio_ring: Fix two use after free bugs	2020-12-30 11:54:00 +01:00
virtio_vdpa.c	virtio_vdpa: legacy features handling	2020-08-05 11:08:40 -04:00
virtio.c	vhost,vdpa,virtio: cleanups, fixes	2020-10-23 11:00:57 -07:00