G. Campana 23c7f01691 virtio_console: fix a crash in config_work_handler ...

[ Upstream commit 8379cadf71 ]

Using control_work instead of config_work as the 3rd argument to
container_of results in an invalid portdev pointer. Indeed, the work
structure is initialized as below:

    INIT_WORK(&portdev->config_work, &config_work_handler);

It leads to a crash when portdev->vdev is dereferenced later. This
bug
is triggered when the guest uses a virtio-console without multiport
feature and receives a config_changed virtio interrupt.

Signed-off-by: G. Campana <gcampana@quarkslab.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-07-05 14:37:18 +02:00

..

agp

agp/uninorth: fix a memleak in create_gatt_table

2015-10-02 22:57:59 +10:00

hw_random

hwrng: core - Don't use a stack buffer in add_early_randomness()

2016-11-18 10:48:36 +01:00

ipmi

ipmi: Fix kernel panic at ipmi_ssif_thread()

2017-05-20 14:27:03 +02:00

mwave

drivers/char: delete non-required instances of include <linux/init.h>

2014-02-07 15:10:19 -08:00

pcmcia

pcmcia: remove left-over %Z format

2017-06-07 12:06:01 +02:00

tpm

tpm_crb: check for bad response size

2017-05-25 14:30:07 +02:00

xilinx_hwicap

char:xilinx_hwicap:buffer_icap - change 1/0 to true/false for bool type variable in function buffer_icap_set_configuration().

2015-06-12 16:58:33 -07:00

xillybus

char: xillybus: Allow 64-bit DMA on PCIe interface

2015-08-05 12:27:09 -07:00

apm-emulation.c

apm-emulation: add hibernation APM events to support suspend2disk

2014-01-07 13:50:28 +01:00

applicom.c

applicom: dereferencing NULL on error path

2014-05-27 17:43:12 -07:00

applicom.h

…

bfin-otp.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

bsr.c

bsr: avoid format string leaking into device name

2014-07-09 16:59:15 -07:00

ds1302.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

ds1620.c

ds1620: single_open() leak

2013-05-05 00:11:29 -04:00

dsp56k.c

drivers/char/dsp56k.c: drop check for negativity of unsigned parameter

2014-07-17 18:38:37 -07:00

dtlk.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

efirtc.c

drivers/char: make efirtc.c driver explicitly non-modular

2015-09-20 19:32:35 -07:00

generic_nvram.c

drivers: fix up various ->llseek() implementations

2011-07-20 20:47:58 -04:00

genrtc.c

rtc: single_open() leaks

2013-05-05 00:12:29 -04:00

hangcheck-timer.c

hangcheck-timer: cleanup casting in hangcheck_init()

2014-11-07 11:24:01 -08:00

hpet.c

drivers/char: make hpet.c explicitly non-modular

2015-09-20 19:32:35 -07:00

Kconfig

char: lack of bool string made CONFIG_DEVPORT always on

2017-04-21 09:30:06 +02:00

lp.c

char: lp: fix possible integer overflow in lp_setup()

2017-05-25 14:30:07 +02:00

Makefile

hwmon: Rename i8k driver to dell-smm-hwmon and move it to hwmon tree

2015-05-24 12:48:12 -07:00

mbcs.c

char: remove use of __devinitconst

2012-11-21 12:55:19 -08:00

mbcs.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

mem.c

drivers: char: mem: Fix wraparound check to allow mappings up to the end

2017-06-14 13:16:26 +02:00

misc.c

char: make misc_deregister a void function

2015-08-05 10:35:49 -07:00

mmtimer.c

drivers/char/mmtimer.c: Remove useless kfree

2012-09-26 13:20:40 -07:00

mspec.c

char: Use vma_pages() to replace (vm_end - vm_start) >> PAGE_SHIFT

2013-05-21 10:07:54 -07:00

nsc_gpio.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

nvram.c

char/nvram: Use bitwise OR to obtain Atari video mode data

2015-08-05 13:30:16 -07:00

nwbutton.c

char: nwbutton: open-code interruptible_sleep_on

2014-01-08 15:29:52 -08:00

nwbutton.h

IRQ: Maintain regs pointer globally rather than passing to IRQ handlers

2006-10-05 15:10:12 +01:00

nwflash.c

Merge branch 'late/fixes' into fixes

2012-10-07 07:22:32 -07:00

pc8736x_gpio.c

pc8736x_gpio: use platform_device_unregister in pc8736x_gpio_cleanup()

2012-10-24 15:52:29 -07:00

ppdev.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

ps3flash.c

ps3flash: switch to generic_file_llseek_size()

2013-06-29 12:57:33 +04:00

random.c

random: properly align get_random_int_hash

2017-06-14 13:16:23 +02:00

raw.c

writeback: separate out include/linux/backing-dev-defs.h

2015-06-02 08:33:34 -06:00

rtc.c

various char drivers: remove deprecated IRQF_DISABLED

2013-10-16 12:36:10 -07:00

scx200_gpio.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

snsc_event.c

various char drivers: remove deprecated IRQF_DISABLED

2013-10-16 12:36:10 -07:00

snsc.c

drivers/char: make SGI snsc.c driver explicitly non-modular

2015-09-20 19:32:35 -07:00

snsc.h

headers: kobject.h redux

2011-01-10 08:51:44 -08:00

sonypi.c

char: drop owner assignment from platform_drivers

2014-10-20 16:20:19 +02:00

tb0219.c

char: drop owner assignment from platform_drivers

2014-10-20 16:20:19 +02:00

tile-srom.c

fs: move struct kiocb to fs.h

2015-03-25 20:28:11 -04:00

tlclk.c

tlclk: remove deprecated IRQF_DISABLED

2013-10-16 12:36:10 -07:00

toshiba.c

toshiba laptop: replace ioremap_cache with ioremap

2015-08-05 17:26:00 -07:00

ttyprintk.c

ttyprintk: Allow built as a module

2014-04-16 14:21:06 -07:00

uv_mmtimer.c

BKL: remove extraneous #include <smp_lock.h>

2010-11-17 08:59:32 -08:00

virtio_console.c

virtio_console: fix a crash in config_work_handler

2017-07-05 14:37:18 +02:00