| commit | dbdfefc71ae555d64bfb29f0d8ee5b76167ce3f3 | [log] [tgz] |
|---|---|---|
| author | Dan Carpenter <[email protected]> | Fri Dec 04 17:23:36 2020 +0300 |
| committer | Greg Kroah-Hartman <[email protected]> | Wed Dec 30 11:54:00 2020 +0100 |
| tree | 1c9ed25510f94624306014f7bca05bc50f8cfd61 | |
| parent | 78b35fd94cf91d782f6e65ed45f0355215f8fb94 [diff] |
virtio_ring: Fix two use after free bugs
[ Upstream commit e152d8af4220a05c9797591609151d404866beaa ]
The "vq" struct is added to the "vdev->vqs" list prematurely. If we
encounter an error later in the function then the "vq" is freed, but
since it is still on the list that could lead to a use after free bug.
Fixes: cbeedb72b97a ("virtio_ring: allocate desc state for split ring separately")
Reported-by: Robert Buhren <[email protected]>
Reported-by: Felicitas Hetzelt <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda
Signed-off-by: Michael S. Tsirkin <[email protected]>
Acked-by: Jason Wang <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>