Files
kernel/include/linux
Andrea Parri (Microsoft) e4d221b423 Drivers: hv: vmbus: Resolve race condition in vmbus_onoffer_rescind()
An erroneous or malicious host could send multiple rescind messages for
a same channel.  In vmbus_onoffer_rescind(), the guest maps the channel
ID to obtain a pointer to the channel object and it eventually releases
such object and associated data.  The host could time rescind messages
and lead to an use-after-free.  Add a new flag to the channel structure
to make sure that only one instance of vmbus_onoffer_rescind() can get
the reference to the channel object.

Reported-by: Juan Vazquez <juvazq@microsoft.com>
Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20201209070827.29335-6-parri.andrea@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
2021-02-05 09:55:42 +00:00
..
2020-12-09 19:26:02 -06:00
2020-12-02 09:46:55 -07:00
2020-12-02 09:46:55 -07:00
2020-12-19 11:18:38 -08:00
2020-12-14 16:24:19 +01:00
2020-12-11 14:02:14 -08:00
2020-12-02 22:00:22 -08:00
2020-12-10 12:42:59 -06:00
2020-12-02 22:10:35 -08:00
2020-11-23 14:16:55 +00:00
2020-12-08 14:14:48 +00:00
2020-11-24 16:47:48 +01:00
2020-12-15 16:19:31 +01:00
2020-12-15 16:19:31 +01:00
2021-01-22 15:09:42 +01:00
2020-12-07 10:29:57 +01:00
2020-12-04 12:23:25 +01:00
2020-12-15 15:11:08 -06:00
2020-12-16 13:08:18 -08:00
2020-12-03 11:20:52 +01:00
2020-12-15 12:13:39 -08:00
2020-12-07 17:12:49 -07:00
2020-12-10 16:17:15 +01:00
2020-12-15 12:13:37 -08:00
2020-11-24 16:47:49 +01:00
2020-12-10 10:45:36 +01:00
2020-12-04 16:54:35 +01:00
2020-12-15 12:13:41 -08:00