On Fri, Oct 27, 2023 at 8:13 PM Dan Carpenter <[email protected]> wrote: > > The put_device() calls vhost_vdpa_release_dev() which calls > ida_simple_remove() and frees "v". So this call to > ida_simple_remove() is a use after free and a double free. > > Fixes: ebe6a354fa7e ("vhost-vdpa: Call ida_simple_remove() when failed") > Signed-off-by: Dan Carpenter <[email protected]>
Acked-by: Jason Wang <[email protected]> Thanks > --- > drivers/vhost/vdpa.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c > index 9a2343c45df0..1aa67729e188 100644 > --- a/drivers/vhost/vdpa.c > +++ b/drivers/vhost/vdpa.c > @@ -1511,7 +1511,6 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa) > > err: > put_device(&v->dev); > - ida_simple_remove(&vhost_vdpa_ida, v->minor); > return r; > } > > -- > 2.42.0 > _______________________________________________ Virtualization mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/virtualization
