summaryrefslogtreecommitdiff
path: root/drivers/char
diff options
context:
space:
mode:
authorG. Campana <gcampana@quarkslab.com>2017-01-19 23:37:46 +0200
committerMichael S. Tsirkin <mst@redhat.com>2017-01-19 23:46:31 +0200
commit8379cadf71c3ee8173a1c6fc1ea7762a9638c047 (patch)
tree7c2fab5b7c5ea52202919e83e0bb0e4801193c21 /drivers/char
parent532e15af105a0b86211f515bd5fec1f4cdd9f27b (diff)
virtio_console: fix a crash in config_work_handler
Using control_work instead of config_work as the 3rd argument to container_of results in an invalid portdev pointer. Indeed, the work structure is initialized as below: INIT_WORK(&portdev->config_work, &config_work_handler); It leads to a crash when portdev->vdev is dereferenced later. This bug is triggered when the guest uses a virtio-console without multiport feature and receives a config_changed virtio interrupt. Signed-off-by: G. Campana <gcampana@quarkslab.com> Reviewed-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'drivers/char')
-rw-r--r--drivers/char/virtio_console.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 8b00e79c2683..17857beb4892 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1862,7 +1862,7 @@ static void config_work_handler(struct work_struct *work)
{
struct ports_device *portdev;
- portdev = container_of(work, struct ports_device, control_work);
+ portdev = container_of(work, struct ports_device, config_work);
if (!use_multiport(portdev)) {
struct virtio_device *vdev;
struct port *port;