mirror of
https://github.com/linuxkit/linuxkit.git
synced 2025-12-04 20:35:46 +00:00
de993ec0d9
- removed some Hyper-V patches which were picked up between 4.4.20 and 4.4.21 - udate aufs Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>
54 lines
1.6 KiB
Diff
54 lines
1.6 KiB
Diff
From f886059ea8d0ac8ed981263d91d94275b85c50d5 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Date: Thu, 4 Aug 2016 14:52:53 +0100
|
|
Subject: [PATCH 12/42] vhost/vsock: fix vhost virtio_vsock_pkt use-after-free
|
|
|
|
Stash the packet length in a local variable before handing over
|
|
ownership of the packet to virtio_transport_recv_pkt() or
|
|
virtio_transport_free_pkt().
|
|
|
|
This patch solves the use-after-free since pkt is no longer guaranteed
|
|
to be alive.
|
|
|
|
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
(cherry picked from commit 3fda5d6e580193fa005014355b3a61498f1b3ae0)
|
|
---
|
|
drivers/vhost/vsock.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
|
|
index 0ddf3a2..e3b30ea 100644
|
|
--- a/drivers/vhost/vsock.c
|
|
+++ b/drivers/vhost/vsock.c
|
|
@@ -307,6 +307,8 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
|
|
|
|
vhost_disable_notify(&vsock->dev, vq);
|
|
for (;;) {
|
|
+ u32 len;
|
|
+
|
|
if (!vhost_vsock_more_replies(vsock)) {
|
|
/* Stop tx until the device processes already
|
|
* pending replies. Leave tx virtqueue
|
|
@@ -334,13 +336,15 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
|
|
continue;
|
|
}
|
|
|
|
+ len = pkt->len;
|
|
+
|
|
/* Only accept correctly addressed packets */
|
|
if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid)
|
|
virtio_transport_recv_pkt(pkt);
|
|
else
|
|
virtio_transport_free_pkt(pkt);
|
|
|
|
- vhost_add_used(vq, head, sizeof(pkt->hdr) + pkt->len);
|
|
+ vhost_add_used(vq, head, sizeof(pkt->hdr) + len);
|
|
added = true;
|
|
}
|
|
|
|
--
|
|
2.10.0
|
|
|