Patchwork [v2,4/4] ixgbe: Fix use after free on module remove

login
register
mail settings
Submitter Alexander Duyck
Date May 3, 2012, 7:19 a.m.
Message ID <20120503071914.13636.31157.stgit@gitlad.jf.intel.com>
Download mbox | patch
Permalink /patch/156621/
State Accepted
Delegated to: David Miller
Headers show

Comments

Alexander Duyck - May 3, 2012, 7:19 a.m.
While testing the TCP changes I had to fix an issue in order to be able to
load and unload the module.

The recent patch that added thermal sensor support added a use after free
bug on module unload with an 82598 adapter in the system.  To resolve the
issue I have updated the code so that when we free the info_kobj we set it
back to NULL.

I suspect there are likely other bugs present, but I will leave that for
another patch that can undergo more testing.

I am submitting this directly to net-next since this fixes a fairly serious
bug that will lock up the ixgbe module until the system is rebooted.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
---

 drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller - May 3, 2012, 8:22 a.m.
From: Alexander Duyck <alexander.h.duyck@intel.com>
Date: Thu, 03 May 2012 00:19:14 -0700

> While testing the TCP changes I had to fix an issue in order to be able to
> load and unload the module.
> 
> The recent patch that added thermal sensor support added a use after free
> bug on module unload with an 82598 adapter in the system.  To resolve the
> issue I have updated the code so that when we free the info_kobj we set it
> back to NULL.
> 
> I suspect there are likely other bugs present, but I will leave that for
> another patch that can undergo more testing.
> 
> I am submitting this directly to net-next since this fixes a fairly serious
> bug that will lock up the ixgbe module until the system is rebooted.
> 
> Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c
index aa41fb7..f81c166 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c
@@ -185,8 +185,10 @@  static void ixgbe_sysfs_del_adapter(struct ixgbe_adapter *adapter)
 		hwmon_device_unregister(adapter->ixgbe_hwmon_buff.device);
 #endif /* CONFIG_IXGBE_HWMON */
 
-	if (adapter->info_kobj != NULL)
+	if (adapter->info_kobj != NULL) {
 		kobject_put(adapter->info_kobj);
+		adapter->info_kobj = NULL;
+	}
 }
 
 /* called from ixgbe_main.c */