lkml.org 
[lkml]   [2012]   [Apr]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH 5/6] vhost_net: fix use after free of vq->ubufs
    From
    Date
    When zerocopy socket is used, ubufs pointer were used in handle_tx()
    without any validation. This would cause NULL pointer deference after
    it has been freed in vhost_net_set_backend(). Fix this by check the
    pointer before using it.

    Signed-off-by: Jason Wang <jasowang@redhat.com>
    ---
    drivers/vhost/net.c | 7 ++++++-
    1 files changed, 6 insertions(+), 1 deletions(-)

    diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
    index f0da2c3..29abd65 100644
    --- a/drivers/vhost/net.c
    +++ b/drivers/vhost/net.c
    @@ -163,10 +163,15 @@ static void handle_tx(struct vhost_net *net)
    mutex_lock(&vq->mutex);
    vhost_disable_notify(&net->dev, vq);

    + zcopy = vhost_sock_zcopy(sock);
    + if (zcopy && !vq->ubufs) {
    + mutex_unlock(&vq->mutex);
    + return;
    + }
    +
    if (wmem < sock->sk->sk_sndbuf / 2)
    tx_poll_stop(net);
    hdr_size = vq->vhost_hlen;
    - zcopy = vhost_sock_zcopy(sock);

    for (;;) {
    /* Release DMAs done buffers first */


    \
     
     \ /
      Last update: 2012-04-16 08:19    [W:0.020 / U:1.324 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site