tree 0ae6185bc3420a78098478572165e9f198b8ba70
parent d05a25fcbf9f9c1a1e90802814ed35dd16010fc3
author Tomasz Figa <tfiga@chromium.org> 1533096396 +0900
committer Tim Detwiler <tjdetwiler@google.com> 1539128223 -0700

CHROMIUM: virtio/wl: Always update *vfd_count on recv, if given

In vfd->hang case, current code would leave *vfd_count unchanged (=
output array size), while it would still return successfully. The caller
would then mistakenly assume that all the vfd pointers in the array are
valid and trigger a NULL pointer dereference.

BUG=none
TEST=Remote disconnect doesn't crash the kernel

Change-Id: I0837704ca2bbf5a94324f4b6f794a192857c6da3
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1158108