github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

This pull request contains the following bug fixes for UML:

Browse Source 
- UAF in UML's vector networking driver
 -----BEGIN PGP SIGNATURE-----
 
 iQJmBAABCABQFiEEdgfidid8lnn52cLTZvlZhesYu8EFAmpstNAbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyFhxyaWNoYXJkQHNpZ21hLXN0YXIuYXQACgkQZvlZ
 hesYu8HLZBAA1/nFbLrAkqHF6TX1r210RrWxHQfzfmE+ER48lYh+fy2Nvq/gcV6G
 vEGdcAFfhstIvH8uJFoPnEClE7s0DzV/vHEBNsqmqF76HgRR88EFSbkvNGFtR9w6
 DwTn3R2grN4cGaEy9phaeMLik3tj2gTfQd9wgTr+hphr6//fBtxhfe6AgIZyHVJu
 JmJq+JyiAbA3Pr6CKT+pojcRgx8clavputOxT/4ZaVIj2S64Cn/+BtYd4p7jYZjS
 IWfnYMKDvnjaDt1eAl758Cc3J+fZdHLc6Ai7rTGwSxqWCubQDz/XQ/WyI3CUuAbL
 cB9BKRJ5GMP13PDsj0qsg2JSDYiRpGtBvOl6WNy4D4G7wipc9GXySw4yUzBM2utL
 wSaISSlcA0GHHbk3GnIsoJDEd8tgo/2f8uUgx6xFtI5nYIpwwEZ6+f4JoZpNu5C0
 dRA9tN6znmpnmGcRaj7Cir81xyqbxER0llyok4e4KgypC1ymWYJwC/+wIrxo+DIC
 GaBlY/nKjzGPzLeHnmlUvWIwmyNqOy1/HajTSRiWZ+ZTu1zb74CRvUEH3fvKMmOU
 kZM/KUSHRR9ufqkaiPLxoP08oEDjfg8DqbhjP7HP/KD6YO3mjod6YRgyKtUeBMhj
 xoBsCVl3earpv/IvWU6yRxIoIGEhl/j15zIHmm6Yjn4e3pvmQnNzVtI=
 =zErw
 -----END PGP SIGNATURE-----

Merge tag 'uml-for-linus-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux

Pull UML fix from Richard Weinberger:

 - Fix use-after-free in UML's vector networking driver

* tag 'uml-for-linus-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux:
  um: vector: fix use-after-free in vector_mmsg_rx()
This commit is contained in:
Linus Torvalds 2026-07-31 09:16:11 -07:00
commit 05b165b6c8
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
arch/um/drivers/vector_kern.c
View File

@ -995,6 +995,9 @@ static int vector_mmsg_rx(struct vector_private *vp, int budget)
*/
dev_kfree_skb_irq(skb);
vp->estats.rx_encaps_errors++;
(*skbuff_vector) = NULL;
mmsg_vector++;
skbuff_vector++;
continue;
}
if (header_check > 0) {