Al Viro 42d8a6dc45 Fix double fget() in vhost_net_set_backend() ... commit fb4554c223 upstream. Descriptor table is a shared resource; two fget() on the same descriptor may return different struct file references. get_tap_ptr_ring() is called after we'd found (and pinned) the socket we'll be using and it tries to find the private tun/tap data structures associated with it. Redoing the lookup by the same file descriptor we'd used to get the socket is racy - we need to same struct file. Thanks to Jason for spotting a braino in the original variant of patch - I'd missed the use of fd == -1 for disabling backend, and in that case we can end up with sock == NULL and sock != oldsock. Cc: stable@kernel.org Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-05-25 09:57:27 +02:00
..
iotlb.c	vhost: handle error while adding split ranges to iotlb	2022-04-08 14:24:12 +02:00
Kconfig
Makefile
net.c	Fix double fget() in vhost_net_set_backend()	2022-05-25 09:57:27 +02:00
scsi.c	vhost scsi: Convert to SPDX identifier	2021-09-05 16:23:08 -04:00
test.c
test.h
vdpa.c	vhost_vdpa: don't setup irq offloading when irq_num < 0	2022-05-25 09:57:25 +02:00
vhost.c	vhost: allow batching hint without size	2022-03-16 14:23:47 +01:00
vhost.h	vhost: fix up vhost_work coding style	2021-07-03 04:50:55 -04:00
vringh.c	vringh: Use wiov->used to check for read/write desc order	2021-08-11 06:44:24 -04:00
vsock.c	vsock: each transport cycles only on its own sockets	2022-03-23 09:16:41 +01:00