提交 02465555 编写于 作者: M Michael S. Tsirkin 提交者: Rusty Russell

virtio_net: fix use after free on allocation failure

In the extremely unlikely event that driver initialization fails after
RX buffers are added, virtio net frees RX buffers while VQs are
still active, potentially causing device to use a freed buffer.

To fix, reset device first - same as we do on device removal.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: NCornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
上级 64b4cc39
...@@ -1830,6 +1830,8 @@ static int virtnet_probe(struct virtio_device *vdev) ...@@ -1830,6 +1830,8 @@ static int virtnet_probe(struct virtio_device *vdev)
return 0; return 0;
free_recv_bufs: free_recv_bufs:
vi->vdev->config->reset(vdev);
free_receive_bufs(vi); free_receive_bufs(vi);
unregister_netdev(dev); unregister_netdev(dev);
free_vqs: free_vqs:
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册