tree 351ecd0bebf5e2e863ad233fe356cf54a08d9ce3
parent 1b8553c04bf95180eb91be94f089a1e8b38cfd62
author Stefan Hajnoczi <stefanha@redhat.com> 1470318773 +0100
committer Michael S. Tsirkin <mst@redhat.com> 1470739357 +0300

vhost/vsock: fix vhost virtio_vsock_pkt use-after-free

Stash the packet length in a local variable before handing over
ownership of the packet to virtio_transport_recv_pkt() or
virtio_transport_free_pkt().

This patch solves the use-after-free since pkt is no longer guaranteed
to be alive.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>