| From 6ca575374dd9a507cdd16dfa0e78c2e9e20bd05f Mon Sep 17 00:00:00 2001 |
| From: Hyunwoo Kim <v4bel@theori.io> |
| Date: Tue, 22 Oct 2024 09:32:56 +0200 |
| Subject: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans |
| |
| From: Hyunwoo Kim <v4bel@theori.io> |
| |
| commit 6ca575374dd9a507cdd16dfa0e78c2e9e20bd05f upstream. |
| |
| During loopback communication, a dangling pointer can be created in |
| vsk->trans, potentially leading to a Use-After-Free condition. This |
| issue is resolved by initializing vsk->trans to NULL. |
| |
| Cc: stable <stable@kernel.org> |
| Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") |
| Signed-off-by: Hyunwoo Kim <v4bel@theori.io> |
| Signed-off-by: Wongi Lee <qwerty@theori.io> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Message-Id: <2024102245-strive-crib-c8d3@gregkh> |
| Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/vmw_vsock/virtio_transport_common.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/net/vmw_vsock/virtio_transport_common.c |
| +++ b/net/vmw_vsock/virtio_transport_common.c |
| @@ -1087,6 +1087,7 @@ void virtio_transport_destruct(struct vs |
| struct virtio_vsock_sock *vvs = vsk->trans; |
| |
| kfree(vvs); |
| + vsk->trans = NULL; |
| } |
| EXPORT_SYMBOL_GPL(virtio_transport_destruct); |
| |
