Al Viro d759015c9b Fix double fget() in vhost_net_set_backend() ... commit fb4554c223 upstream. Descriptor table is a shared resource; two fget() on the same descriptor may return different struct file references. get_tap_ptr_ring() is called after we'd found (and pinned) the socket we'll be using and it tries to find the private tun/tap data structures associated with it. Redoing the lookup by the same file descriptor we'd used to get the socket is racy - we need to same struct file. Thanks to Jason for spotting a braino in the original variant of patch - I'd missed the use of fd == -1 for disabling backend, and in that case we can end up with sock == NULL and sock != oldsock. Cc: stable@kernel.org Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-05-25 09:59:03 +02:00
..
iotlb.c	vhost: handle error while adding split ranges to iotlb	2022-04-08 13:58:58 +02:00
Kconfig	vhost_vdpa: implement IRQ offloading in vhost_vdpa	2020-08-05 11:08:42 -04:00
Makefile	vhost: introduce vDPA-based backend	2020-04-02 10:41:40 -04:00
net.c	Fix double fget() in vhost_net_set_backend()	2022-05-25 09:59:03 +02:00
scsi.c	vhost scsi: Convert to SPDX identifier	2021-09-05 16:23:08 -04:00
test.c	vhost/test: fix memory leak of vhost virtqueues	2022-01-14 18:50:53 -05:00
test.h	tools/virtio: Add --reset	2020-06-22 12:34:21 -04:00
vdpa.c	vhost_vdpa: don't setup irq offloading when irq_num < 0	2022-05-25 09:59:00 +02:00
vhost.c	vhost: allow batching hint without size	2022-03-10 08:12:04 -05:00
vhost.h	vhost: fix up vhost_work coding style	2021-07-03 04:50:55 -04:00
vringh.c	vringh: Use wiov->used to check for read/write desc order	2021-08-11 06:44:24 -04:00
vsock.c	vsock: each transport cycles only on its own sockets	2022-03-11 23:14:19 -08:00