| commit | 3fda5d6e580193fa005014355b3a61498f1b3ae0 | [log] [tgz] |
|---|---|---|
| author | Stefan Hajnoczi <stefanha@redhat.com> | Thu Aug 04 13:52:53 2016 |
| committer | Michael S. Tsirkin <mst@redhat.com> | Tue Aug 09 10:42:37 2016 |
| tree | 351ecd0bebf5e2e863ad233fe356cf54a08d9ce3 | |
| parent | 1b8553c04bf95180eb91be94f089a1e8b38cfd62 [diff] |
vhost/vsock: fix vhost virtio_vsock_pkt use-after-free Stash the packet length in a local variable before handing over ownership of the packet to virtio_transport_recv_pkt() or virtio_transport_free_pkt(). This patch solves the use-after-free since pkt is no longer guaranteed to be alive. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>