Fix use after free in get_capset_info callback.
authorDoug Horn <doughorn@google.com>
Wed, 2 Sep 2020 21:08:25 +0000 (14:08 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 29 Oct 2020 09:08:26 +0000 (10:08 +0100)
commit0c1943f203c2da9e78dae5fb1dbbfd2bf1a11aa9
tree2a8145ebfe2d50895cdd9a234ac196e40da45d72
parent4d779accb71b2eb95f51f9928742cbf4f197828d
Fix use after free in get_capset_info callback.

[ Upstream commit e219688fc5c3d0d9136f8d29d7e0498388f01440 ]

If a response to virtio_gpu_cmd_get_capset_info takes longer than
five seconds to return, the callback will access freed kernel memory
in vg->capsets.

Signed-off-by: Doug Horn <doughorn@google.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20200902210847.2689-2-gurchetansingh@chromium.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/drm/virtio/virtgpu_kms.c
drivers/gpu/drm/virtio/virtgpu_vq.c