Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 27 Sep 2018 16:33:21 +0100
From:   Stefan Hajnoczi <stefanha@redhat.com>
To:     Jason Wang <jasowang@redhat.com>
Cc:     mst@redhat.com, kvm@vger.kernel.org,
        virtualization@lists.linux-foundation.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, sergei.shtylyov@cogentembedded.com
Subject: Re: [PATCH net V2] vhost-vsock: fix use after free
Message-ID: <20180927153321.GB10133@stefanha-x1.localdomain>
References: <20180927122204.4188-1-jasowang@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
        protocol="application/pgp-signature"; boundary="O5XBE6gyVG5Rl6Rj"
Content-Disposition: inline
In-Reply-To: <20180927122204.4188-1-jasowang@redhat.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


--O5XBE6gyVG5Rl6Rj
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 27, 2018 at 08:22:04PM +0800, Jason Wang wrote:
> The access of vsock is not protected by vhost_vsock_lock. This may
> lead to use after free since vhost_vsock_dev_release() may free the
> pointer at the same time.
>=20
> Fix this by holding the lock during the access.
>=20
> Reported-by: syzbot+e3e074963495f92a89ed@syzkaller.appspotmail.com
> Fixes: 16320f363ae1 ("vhost-vsock: add pkt cancel capability")
> Fixes: 433fc58e6bf2 ("VSOCK: Introduce vhost_vsock.ko")
> Cc: Stefan Hajnoczi <stefanha@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
> - V2: fix typos
> - The patch is needed for -stable.
> ---
>  drivers/vhost/vsock.c | 26 +++++++++++++++++++-------
>  1 file changed, 19 insertions(+), 7 deletions(-)

Thank you, Jason!

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

--O5XBE6gyVG5Rl6Rj
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJbrPhBAAoJEJykq7OBq3PI4+YH/iTCwaaWk6eiQLX6SQFLM1S5
dtkS+0+ja7FhmKnTwHQYN+tB025xfmFwtDhSEb+F582co7ggqflOhNUdh3t8Ehel
SNkeDGEeolpB1IX5evuvbnZuFpAjPhMqBIUqnoxIoJNAyYo6fMbQkdfyBXnqDsnH
c5oS9yz5OvUzu4IhR/KYqKtljwZNUcniitMKYNN1+LpH7g0QzLpeAs3FADVtoNUB
HEAFFhvOa7k+7EFJfw7FgccC5zWsDSVyoVtdxtFK2BPujrW3JfFLRWKQgrUKhY2u
TKVp0htYP4qG2YXbBPjbbC8OUrILllvtxENF2mgZZXvDE3lIZw9Vl8b5+WVVrlo=
=wXAN
-----END PGP SIGNATURE-----

--O5XBE6gyVG5Rl6Rj--