Unverified Commit 7e717645 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11855 VMCI: Fix use-after-free when removing resource in vmci_resource_remove() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Kunbo <zhangkunbo@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/2SOOOUETWMBU6X3EGLA57W5ZZR4SCZKF/ 
 
https://gitee.com/src-openeuler/kernel/issues/IARY1L 
 
Link:https://gitee.com/openeuler/kernel/pulls/11855

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents f9510969 2f273c88

drivers/misc/vmw_vmci/vmci_resource.c

+2 −1
Original line number Diff line number Diff line
@@ -152,7 +152,8 @@ void vmci_resource_remove(struct vmci_resource *resource) 
	spin_lock(&vmci_resource_table.lock);



	hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) {

		if (vmci_handle_is_equal(r->handle, resource->handle)) {

		if (vmci_handle_is_equal(r->handle, resource->handle) &&

		    resource->type == r->type) {

			hlist_del_init_rcu(&r->node);

			break;

		}