vhost-vdpa: fix use after free in vhost_vdpa_probe()

Browse source

[ Upstream commit e07754e0a1 ]

The put_device() calls vhost_vdpa_release_dev() which calls
ida_simple_remove() and frees "v".  So this call to
ida_simple_remove() is a use after free and a double free.

Fixes: ebe6a354fa ("vhost-vdpa: Call ida_simple_remove() when failed")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Message-Id: <cf53cb61-0699-4e36-a980-94fd4268ff00@moroto.mountain>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Dan Carpenter 2023-10-27 15:12:54 +03:00 • committed by Greg Kroah-Hartman

parent 941fcbb0f0

commit bf04132cd6

1 changed files with 0 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

drivers/vhost/vdpa.c

View file