diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-07-31 09:16:11 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-07-31 09:16:11 -0700 |
| commit | 05b165b6c8ab87e11222f99654f878885fb437f4 (patch) | |
| tree | 4563455a43a3d5b1b60753548c150aca9fc6f68e | |
| parent | 7c7ed510824b1035a9bf7c3347a946f3ada81299 (diff) | |
| parent | af421e9aed3920c7ac88c24daa48606c7112feca (diff) | |
Merge tag 'uml-for-linus-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux
Pull UML fix from Richard Weinberger:
- Fix use-after-free in UML's vector networking driver
* tag 'uml-for-linus-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux:
um: vector: fix use-after-free in vector_mmsg_rx()
| -rw-r--r-- | arch/um/drivers/vector_kern.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c index 2cc90055499a..8a70b3a62553 100644 --- a/arch/um/drivers/vector_kern.c +++ b/arch/um/drivers/vector_kern.c @@ -995,6 +995,9 @@ static int vector_mmsg_rx(struct vector_private *vp, int budget) */ dev_kfree_skb_irq(skb); vp->estats.rx_encaps_errors++; + (*skbuff_vector) = NULL; + mmsg_vector++; + skbuff_vector++; continue; } if (header_check > 0) { |