diff mbox

xen-netback: don't de-reference vif pointer after having called xenvif_put()

Message ID 51AF613F02000078000DB84E@nat28.tlf.novell.com
State Changes Requested, archived
Delegated to: David Miller
Headers show

Commit Message

Jan Beulich June 5, 2013, 2:03 p.m. UTC 
When putting vif-s on the rx notify list, calling xenvif_put() must be
deferred until after the removal from the list and the issuing of the
notification, as both operations dereference the pointer.

Changing this got me to notice that the "irq" variable was effectively
unused (and was of too narrow type anyway).

Signed-off-by: Jan Beulich <jbeulich@suse.com>

---
 drivers/net/xen-netback/netback.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)
xen-netback: don't de-reference vif pointer after having called xenvif_put()

When putting vif-s on the rx notify list, calling xenvif_put() must be
deferred until after the removal from the list and the issuing of the
notification, as both operations dereference the pointer.

Changing this got me to notice that the "irq" variable was effectively
unused (and was of too narrow type anyway).

Signed-off-by: Jan Beulich <jbeulich@suse.com>

---
 drivers/net/xen-netback/netback.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- 3.10-rc4/drivers/net/xen-netback/netback.c
+++ 3.10-rc4-xen-netback-vif-use-after-free/drivers/net/xen-netback/netback.c
@@ -662,7 +662,7 @@ static void xen_netbk_rx_action(struct x
 {
 	struct xenvif *vif = NULL, *tmp;
 	s8 status;
-	u16 irq, flags;
+	u16 flags;
 	struct xen_netif_rx_response *resp;
 	struct sk_buff_head rxq;
 	struct sk_buff *skb;
@@ -771,13 +771,13 @@ static void xen_netbk_rx_action(struct x
 					 sco->meta_slots_used);
 
 		RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&vif->rx, ret);
-		irq = vif->irq;
-		if (ret && list_empty(&vif->notify_list))
-			list_add_tail(&vif->notify_list, &notify);
 
 		xenvif_notify_tx_completion(vif);
 
-		xenvif_put(vif);
+		if (ret && list_empty(&vif->notify_list))
+			list_add_tail(&vif->notify_list, &notify);
+		else
+			xenvif_put(vif);
 		npo.meta_cons += sco->meta_slots_used;
 		dev_kfree_skb(skb);
 	}
@@ -785,6 +785,7 @@ static void xen_netbk_rx_action(struct x
 	list_for_each_entry_safe(vif, tmp, &notify, notify_list) {
 		notify_remote_via_irq(vif->irq);
 		list_del_init(&vif->notify_list);
+		xenvif_put(vif);
 	}
 
 	/* More work to do? */

Comments

Ian Campbell June 5, 2013, 3:13 p.m. UTC | #1 
On Wed, 2013-06-05 at 15:03 +0100, Jan Beulich wrote:
> When putting vif-s on the rx notify list, calling xenvif_put() must be
> deferred until after the removal from the list and the issuing of the
> notification, as both operations dereference the pointer.
> 
> Changing this got me to notice that the "irq" variable was effectively
> unused (and was of too narrow type anyway).
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Acked-by: Ian Campbell <ian.campbell@citrix.com>


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller June 11, 2013, 9:01 a.m. UTC | #2 
From: "Jan Beulich" <JBeulich@suse.com>
Date: Wed, 05 Jun 2013 15:03:11 +0100

> When putting vif-s on the rx notify list, calling xenvif_put() must be
> deferred until after the removal from the list and the issuing of the
> notification, as both operations dereference the pointer.
> 
> Changing this got me to notice that the "irq" variable was effectively
> unused (and was of too narrow type anyway).
> 
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

You've included the commit message, and the patch, twice.  Once inline
and once as an attachment, do not do this.  It makes the patch impossible
to apply when I fetch it out of patchwork.

Please submit it properly.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Jan Beulich June 11, 2013, 9:59 a.m. UTC | #3 
>>> On 11.06.13 at 11:01, David Miller <davem@davemloft.net> wrote:
> From: "Jan Beulich" <JBeulich@suse.com>
> Date: Wed, 05 Jun 2013 15:03:11 +0100
> 
>> When putting vif-s on the rx notify list, calling xenvif_put() must be
>> deferred until after the removal from the list and the issuing of the
>> notification, as both operations dereference the pointer.
>> 
>> Changing this got me to notice that the "irq" variable was effectively
>> unused (and was of too narrow type anyway).
>> 
>> Signed-off-by: Jan Beulich <jbeulich@suse.com>
> 
> You've included the commit message, and the patch, twice.  Once inline
> and once as an attachment, do not do this.  It makes the patch impossible
> to apply when I fetch it out of patchwork.
> 
> Please submit it properly.

Sending to multiple lists makes it impossible to match everyone's
preferences/requirements. xen-devel generally wants patches
inline and attached (for the case where the inline variant gets
mangled by mail programs).

I'll resend inline only, in the hope that it'll reach your inbox intact.

Jan

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller June 11, 2013, 8 p.m. UTC | #4 
From: "Jan Beulich" <JBeulich@suse.com>
Date: Tue, 11 Jun 2013 10:59:39 +0100

>>>> On 11.06.13 at 11:01, David Miller <davem@davemloft.net> wrote:
>> From: "Jan Beulich" <JBeulich@suse.com>
>> Date: Wed, 05 Jun 2013 15:03:11 +0100
>> 
>>> When putting vif-s on the rx notify list, calling xenvif_put() must be
>>> deferred until after the removal from the list and the issuing of the
>>> notification, as both operations dereference the pointer.
>>> 
>>> Changing this got me to notice that the "irq" variable was effectively
>>> unused (and was of too narrow type anyway).
>>> 
>>> Signed-off-by: Jan Beulich <jbeulich@suse.com>
>> 
>> You've included the commit message, and the patch, twice.  Once inline
>> and once as an attachment, do not do this.  It makes the patch impossible
>> to apply when I fetch it out of patchwork.
>> 
>> Please submit it properly.
> 
> Sending to multiple lists makes it impossible to match everyone's
> preferences/requirements. xen-devel generally wants patches
> inline and attached (for the case where the inline variant gets
> mangled by mail programs).

That's rediculous.  Fix your mail client setup, and send it inline
only.

Otherwise people can't reply and comment inline to the content of
your patch properly.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

--- 3.10-rc4/drivers/net/xen-netback/netback.c
+++ 3.10-rc4-xen-netback-vif-use-after-free/drivers/net/xen-netback/netback.c
@@ -662,7 +662,7 @@  static void xen_netbk_rx_action(struct x
 {
 	struct xenvif *vif = NULL, *tmp;
 	s8 status;
-	u16 irq, flags;
+	u16 flags;
 	struct xen_netif_rx_response *resp;
 	struct sk_buff_head rxq;
 	struct sk_buff *skb;
@@ -771,13 +771,13 @@  static void xen_netbk_rx_action(struct x
 					 sco->meta_slots_used);
 
 		RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&vif->rx, ret);
-		irq = vif->irq;
-		if (ret && list_empty(&vif->notify_list))
-			list_add_tail(&vif->notify_list, &notify);
 
 		xenvif_notify_tx_completion(vif);
 
-		xenvif_put(vif);
+		if (ret && list_empty(&vif->notify_list))
+			list_add_tail(&vif->notify_list, &notify);
+		else
+			xenvif_put(vif);
 		npo.meta_cons += sco->meta_slots_used;
 		dev_kfree_skb(skb);
 	}
@@ -785,6 +785,7 @@  static void xen_netbk_rx_action(struct x
 	list_for_each_entry_safe(vif, tmp, &notify, notify_list) {
 		notify_remote_via_irq(vif->irq);
 		list_del_init(&vif->notify_list);
+		xenvif_put(vif);
 	}
 
 	/* More work to do? */