Dan Carpenter 3e9bf43f7f Drivers: hv: vmbus: Use after free in __vmbus_open() ...

The "open_info" variable is added to the &vmbus_connection.chn_msg_list,
but the error handling frees "open_info" without removing it from the
list.  This will result in a use after free.  First remove it from the
list, and then free it.

Fixes: 6f3d791f3006 ("Drivers: hv: vmbus: Fix rescind handling issues")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://lore.kernel.org/r/YHV3XLCot6xBS44r@mwanda
Signed-off-by: Wei Liu <wei.liu@kernel.org>

2021-04-16 10:36:33 +00:00

..

channel_mgmt.c

drivers: hv: Fix EXPORT_SYMBOL and tab spaces issue

2021-03-22 10:55:03 +00:00

channel.c

Drivers: hv: vmbus: Use after free in __vmbus_open()

2021-04-16 10:36:33 +00:00

connection.c

drivers: hv: Fix whitespace errors

2021-03-08 17:32:58 +00:00

hv_balloon.c

x86/Hyper-V: Support for free page reporting

2021-03-24 11:35:24 +00:00

hv_debugfs.c

hv_debugfs: Make hv_debug_root static

2020-04-04 17:47:43 +01:00

hv_fcopy.c

Revert "Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer"

2021-02-15 10:49:11 +00:00

hv_kvp.c

Revert "Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer"

2021-02-15 10:49:11 +00:00

hv_snapshot.c

hv_utils: Add validation for untrusted Hyper-V values

2021-02-05 09:55:42 +00:00

hv_trace_balloon.h

hv_balloon: trace post_status

2018-03-06 09:57:17 -08:00

hv_trace.c

hv: add SPDX license to trace

2018-03-28 13:24:56 +02:00

hv_trace.h

hyperv-next for 5.8

2020-06-03 15:00:05 -07:00

hv_util.c

hv_utils: Fix spelling mistake "Hearbeat" -> "Heartbeat"

2021-02-11 08:47:05 +00:00

hv_utils_transport.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 280

2019-06-05 17:36:36 +02:00

hv_utils_transport.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 280

2019-06-05 17:36:36 +02:00

hv.c

Drivers: hv: vmbus: Remove unused linux/version.h header

2021-04-02 22:09:46 +00:00

hyperv_vmbus.h

Revert "Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer"

2021-02-15 10:49:11 +00:00

Kconfig

x86/Hyper-V: Support for free page reporting

2021-03-24 11:35:24 +00:00

Makefile

drivers: hv: vmbus: Introduce latency testing

2019-11-21 20:10:44 -05:00

ring_buffer.c

Drivers: hv: vmbus: remove unused function

2021-04-14 15:14:02 +00:00

vmbus_drv.c

Drivers: hv: vmbus: Move handling of VMbus interrupts

2021-03-08 17:33:00 +00:00