![]() Stash the packet length in a local variable before handing over ownership of the packet to virtio_transport_recv_pkt() or virtio_transport_free_pkt(). This patch solves the use-after-free since pkt is no longer guaranteed to be alive. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
||
---|---|---|
.. | ||
Kconfig | ||
Kconfig.vringh | ||
Makefile | ||
net.c | ||
scsi.c | ||
test.c | ||
test.h | ||
vhost.c | ||
vhost.h | ||
vringh.c | ||
vsock.c |