| Message ID | 1529557891-4828-1-git-send-email-jasowang@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
From: Jason Wang <jasowang@redhat.com> Date: Thu, 21 Jun 2018 13:11:31 +0800 > Sock will be NULL if we pass -1 to vhost_net_set_backend(), but when > we meet errors during ubuf allocation, the code does not check for > NULL before calling sockfd_put(), this will lead NULL > dereferencing. Fixing by checking sock pointer before. > > Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support") > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Jason Wang <jasowang@redhat.com> Applied and queued up for -stable, thanks Jason.
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index 986058a..b97a994 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -1208,7 +1208,8 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd) if (ubufs) vhost_net_ubuf_put_wait_and_free(ubufs); err_ubufs: - sockfd_put(sock); + if (sock) + sockfd_put(sock); err_vq: mutex_unlock(&vq->mutex); err:
Sock will be NULL if we pass -1 to vhost_net_set_backend(), but when we meet errors during ubuf allocation, the code does not check for NULL before calling sockfd_put(), this will lead NULL dereferencing. Fixing by checking sock pointer before. Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Jason Wang <jasowang@redhat.com> --- drivers/vhost/net.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)