From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>,
Jason Wang <jasowang@redhat.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.18 23/29] vhost_net: validate sock before trying to put its fd
Date: Fri, 20 Jul 2018 14:11:18 +0200 [thread overview]
Message-ID: <20180720115159.809868746@linuxfoundation.org> (raw)
In-Reply-To: <20180720115158.974693829@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
[ Upstream commit b8f1f65882f07913157c44673af7ec0b308d03eb ]
Sock will be NULL if we pass -1 to vhost_net_set_backend(), but when
we meet errors during ubuf allocation, the code does not check for
NULL before calling sockfd_put(), this will lead NULL
dereferencing. Fixing by checking sock pointer before.
Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vhost/net.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -983,7 +983,8 @@ err_used:
if (ubufs)
vhost_net_ubuf_put_wait_and_free(ubufs);
err_ubufs:
- sockfd_put(sock);
+ if (sock)
+ sockfd_put(sock);
err_vq:
mutex_unlock(&vq->mutex);
err:
next prev parent reply other threads:[~2018-07-20 12:26 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-20 12:10 [PATCH 3.18 00/29] 3.18.116-stable review Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 01/29] ibmasm: dont write out of bounds in read handler Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 02/29] USB: serial: keyspan_pda: fix modem-status error handling Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 03/29] USB: yurex: fix out-of-bounds uaccess in read handler Greg Kroah-Hartman
2018-07-20 12:10 ` [PATCH 3.18 04/29] USB: serial: mos7840: fix status-register error handling Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 05/29] usb: quirks: add delay quirks for Corsair Strafe Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 06/29] xhci: xhci-mem: off by one in xhci_stream_id_to_ring() Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 07/29] Fix up non-directory creation in SGID directories Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 08/29] netfilter: x_tables: initialise match/target check parameter struct Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 09/29] loop: add recursion validation to LOOP_CHANGE_FD Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 10/29] PM / hibernate: Fix oops at snapshot_write() Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 11/29] RDMA/ucm: Mark UCM interface as BROKEN Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 12/29] loop: remember whether sysfs_create_group() was done Greg Kroah-Hartman
2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 13/29] bcm63xx_enet: correct clock usage Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 14/29] bcm63xx_enet: do not write to random DMA channel on BCM6345 Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 15/29] crypto: crypto4xx - remove bad list_del Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 16/29] crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 17/29] net: dccp: avoid crash in ccid3_hc_rx_send_feedback() Greg Kroah-Hartman
2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 18/29] net: dccp: switch rx_tstamp_last_feedback to monotonic clock Greg Kroah-Hartman
2018-07-20 12:11 ` Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 19/29] net/mlx5: Fix incorrect raw command length parsing Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 20/29] net: sungem: fix rx checksum support Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 21/29] tcp: fix Fast Open key endianness Greg Kroah-Hartman
2018-07-20 12:11 ` Greg Kroah-Hartman [this message]
2018-07-20 12:11 ` [PATCH 3.18 24/29] net_sched: blackhole: tell upper qdisc about dropped packets Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 25/29] net/mlx5: Fix command interface race in polling mode Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 26/29] netfilter: ebtables: reject non-bridge targets Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 27/29] KEYS: DNS: fix parsing multiple options Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 28/29] rds: avoid unenecessary cong_update in loop transport Greg Kroah-Hartman
2018-07-20 12:11 ` [PATCH 3.18 29/29] net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL Greg Kroah-Hartman
2018-07-20 13:33 ` [PATCH 3.18 00/29] 3.18.116-stable review Nathan Chancellor
2018-07-21 13:38 ` Guenter Roeck
2018-07-22 11:42 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180720115159.809868746@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=jasowang@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.