Dan Carpenter dbdfefc71a virtio_ring: Fix two use after free bugs ... [ Upstream commit e152d8af4220a05c9797591609151d404866beaa ] The "vq" struct is added to the "vdev->vqs" list prematurely. If we encounter an error later in the function then the "vq" is freed, but since it is still on the list that could lead to a use after free bug. Fixes: cbeedb72b9 ("virtio_ring: allocate desc state for split ring separately") Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de> Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-12-30 11:54:00 +01:00
..
Kconfig	vhost,vdpa,virtio: cleanups, fixes	2020-10-23 11:00:57 -07:00
Makefile
virtio_balloon.c	virtio-balloon: Constify id_table	2020-10-21 10:34:08 -04:00
virtio_dma_buf.c
virtio_input.c	virtio_input: Constify id_table	2020-10-21 10:34:09 -04:00
virtio_mem.c	vhost,vdpa,virtio: cleanups, fixes	2020-10-23 11:00:57 -07:00
virtio_mmio.c
virtio_pci_common.c
virtio_pci_common.h
virtio_pci_legacy.c
virtio_pci_modern.c
virtio_ring.c	virtio_ring: Fix two use after free bugs	2020-12-30 11:54:00 +01:00
virtio_vdpa.c
virtio.c	vhost,vdpa,virtio: cleanups, fixes	2020-10-23 11:00:57 -07:00