Michael S. Tsirkin
2023-Nov-01 05:33 UTC
[PATCH net-XXX] vhost-vdpa: fix use after free in vhost_vdpa_probe()
On Fri, Oct 27, 2023 at 03:12:54PM +0300, Dan Carpenter wrote:> The put_device() calls vhost_vdpa_release_dev() which calls > ida_simple_remove() and frees "v". So this call to > ida_simple_remove() is a use after free and a double free. > > Fixes: ebe6a354fa7e ("vhost-vdpa: Call ida_simple_remove() when failed") > Signed-off-by: Dan Carpenter <dan.carpenter at linaro.org>queued, thanks!> --- > drivers/vhost/vdpa.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c > index 9a2343c45df0..1aa67729e188 100644 > --- a/drivers/vhost/vdpa.c > +++ b/drivers/vhost/vdpa.c > @@ -1511,7 +1511,6 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa) > > err: > put_device(&v->dev); > - ida_simple_remove(&vhost_vdpa_ida, v->minor); > return r; > } > > -- > 2.42.0