| Message ID | 1432737970-31872-1-git-send-email-david.vrabel@citrix.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On 05/27/2015 10:46 AM, David Vrabel wrote: > xennet_remove() freed the queues before freeing the netdevice which > results in a use-after-free when free_netdev() tries to delete the > napi instances that have already been freed. > > Fix this by fully destroy the queues (which includes deleting the napi > instances) before freeing the netdevice. > > Signed-off-by: David Vrabel <david.vrabel@citrix.com> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> > --- > drivers/net/xen-netfront.c | 15 ++------------- > 1 file changed, 2 insertions(+), 13 deletions(-) > > diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c > index 3f45afd..e031c94 100644 > --- a/drivers/net/xen-netfront.c > +++ b/drivers/net/xen-netfront.c > @@ -1698,6 +1698,7 @@ static void xennet_destroy_queues(struct netfront_info *info) > > if (netif_running(info->netdev)) > napi_disable(&queue->napi); > + del_timer_sync(&queue->rx_refill_timer); > netif_napi_del(&queue->napi); > } > > @@ -2102,9 +2103,6 @@ static const struct attribute_group xennet_dev_group = { > static int xennet_remove(struct xenbus_device *dev) > { > struct netfront_info *info = dev_get_drvdata(&dev->dev); > - unsigned int num_queues = info->netdev->real_num_tx_queues; > - struct netfront_queue *queue = NULL; > - unsigned int i = 0; > > dev_dbg(&dev->dev, "%s\n", dev->nodename); > > @@ -2112,16 +2110,7 @@ static int xennet_remove(struct xenbus_device *dev) > > unregister_netdev(info->netdev); > > - for (i = 0; i < num_queues; ++i) { > - queue = &info->queues[i]; > - del_timer_sync(&queue->rx_refill_timer); > - } > - > - if (num_queues) { > - kfree(info->queues); > - info->queues = NULL; > - } > - > + xennet_destroy_queues(info); > xennet_free_netdev(info->netdev); > > return 0; -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: David Vrabel <david.vrabel@citrix.com> Date: Wed, 27 May 2015 15:46:10 +0100 > xennet_remove() freed the queues before freeing the netdevice which > results in a use-after-free when free_netdev() tries to delete the > napi instances that have already been freed. > > Fix this by fully destroy the queues (which includes deleting the napi > instances) before freeing the netdevice. > > Signed-off-by: David Vrabel <david.vrabel@citrix.com> Applied, thanks David. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 3f45afd..e031c94 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -1698,6 +1698,7 @@ static void xennet_destroy_queues(struct netfront_info *info) if (netif_running(info->netdev)) napi_disable(&queue->napi); + del_timer_sync(&queue->rx_refill_timer); netif_napi_del(&queue->napi); } @@ -2102,9 +2103,6 @@ static const struct attribute_group xennet_dev_group = { static int xennet_remove(struct xenbus_device *dev) { struct netfront_info *info = dev_get_drvdata(&dev->dev); - unsigned int num_queues = info->netdev->real_num_tx_queues; - struct netfront_queue *queue = NULL; - unsigned int i = 0; dev_dbg(&dev->dev, "%s\n", dev->nodename); @@ -2112,16 +2110,7 @@ static int xennet_remove(struct xenbus_device *dev) unregister_netdev(info->netdev); - for (i = 0; i < num_queues; ++i) { - queue = &info->queues[i]; - del_timer_sync(&queue->rx_refill_timer); - } - - if (num_queues) { - kfree(info->queues); - info->queues = NULL; - } - + xennet_destroy_queues(info); xennet_free_netdev(info->netdev); return 0;
xennet_remove() freed the queues before freeing the netdevice which results in a use-after-free when free_netdev() tries to delete the napi instances that have already been freed. Fix this by fully destroy the queues (which includes deleting the napi instances) before freeing the netdevice. Signed-off-by: David Vrabel <david.vrabel@citrix.com> --- drivers/net/xen-netfront.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-)