Files
linux-stable-mirror/include/linux
Andrea Parri (Microsoft) e4d221b423 Drivers: hv: vmbus: Resolve race condition in vmbus_onoffer_rescind()
An erroneous or malicious host could send multiple rescind messages for
a same channel.  In vmbus_onoffer_rescind(), the guest maps the channel
ID to obtain a pointer to the channel object and it eventually releases
such object and associated data.  The host could time rescind messages
and lead to an use-after-free.  Add a new flag to the channel structure
to make sure that only one instance of vmbus_onoffer_rescind() can get
the reference to the channel object.

Reported-by: Juan Vazquez <juvazq@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20201209070827.29335-6-parri.andrea@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2021-02-05 09:55:42 +00:00
..
2020-12-19 11:18:38 -08:00
2020-12-15 16:19:31 +01:00
2020-12-15 16:19:31 +01:00
2021-01-22 15:09:42 +01:00
2020-12-15 15:11:08 -06:00
2020-12-16 13:08:18 -08:00
2020-12-15 12:13:39 -08:00
2020-12-15 12:13:37 -08:00
2020-12-15 12:13:41 -08:00