mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-10-22 19:14:51 +00:00
4ec5e932e6
qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but
copies into the migration-state buffer after taking the lock and
re-reading the shared file position.
Two concurrent writers could therefore pass the bounds check with the
old offset, then have the second writer copy after the first advanced
f_pos, writing past the end of the migration-state buffer.
Take migf->lock before doing the boundary checks.
Fixes:
|
History
|
|
|---|---|---|
| .. | ||
| cdx | ||
| fsl-mc | ||
| mdev | ||
| pci | ||
| platform | ||
| container.c | ||
| debugfs.c | ||
| device_cdev.c | ||
| group.c | ||
| iommufd.c | ||
| Kconfig | ||
| Makefile | ||
| vfio.h | ||
| vfio_iommu_spapr_tce.c | ||
| vfio_iommu_type1.c | ||
| vfio_main.c | ||
| virqfd.c | ||