Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 16 Apr 2021 10:37:24 +0000
From:   Wei Liu <wei.liu@kernel.org>
To:     Andrea Parri <parri.andrea@gmail.com>
Cc:     Dan Carpenter <dan.carpenter@oracle.com>,
        "K. Y. Srinivasan" <kys@microsoft.com>,
        Haiyang Zhang <haiyangz@microsoft.com>,
        Stephen Hemminger <sthemmin@microsoft.com>,
        Wei Liu <wei.liu@kernel.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Dexuan Cui <decui@microsoft.com>, linux-hyperv@vger.kernel.org,
        linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] Drivers: hv: vmbus: Use after free in __vmbus_open()
Message-ID: <20210416103724.f3unhyu72pbp2qr3@liuwe-devbox-debian-v2>
References: <YHV3XLCot6xBS44r@mwanda>
 <20210413154221.GA2369@anparri>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210413154221.GA2369@anparri>
Precedence: bulk

On Tue, Apr 13, 2021 at 05:42:21PM +0200, Andrea Parri wrote:
> On Tue, Apr 13, 2021 at 01:50:04PM +0300, Dan Carpenter wrote:
> > The "open_info" variable is added to the &vmbus_connection.chn_msg_list,
> > but the error handling frees "open_info" without removing it from the
> > list.  This will result in a use after free.  First remove it from the
> > list, and then free it.
> > 
> > Fixes: 6f3d791f3006 ("Drivers: hv: vmbus: Fix rescind handling issues")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> I had this 'queued' in my list,
> 
> Reviewed-by: Andrea Parri <parri.andrea@gmail.com>

Applied. Thanks.