mirror of
https://github.com/torvalds/linux.git
synced 2026-10-07 19:16:02 +02:00
4ec5e932e6
qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but
copies into the migration-state buffer after taking the lock and
re-reading the shared file position.
Two concurrent writers could therefore pass the bounds check with the
old offset, then have the second writer copy after the first advanced
f_pos, writing past the end of the migration-state buffer.
Take migf->lock before doing the boundary checks.
Fixes:
|
||
|---|---|---|
| .. | ||
| cdx | ||
| fsl-mc | ||
| mdev | ||
| pci | ||
| platform | ||
| container.c | ||
| debugfs.c | ||
| device_cdev.c | ||
| group.c | ||
| iommufd.c | ||
| Kconfig | ||
| Makefile | ||
| vfio_iommu_spapr_tce.c | ||
| vfio_iommu_type1.c | ||
| vfio_main.c | ||
| vfio.h | ||
| virqfd.c | ||