Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings
forked fromtorvalds/linux

Commit76bb5db

Browse files
shemmingerdavem330
authored andcommitted
netvsc: fix use after free on module removal
The NAPI data structure is embedded in the netvsc_device structureand is freed when device is closed. There is still a reference(in NAPI list) to this which causes a crash in netif_napi_delwhen device is removed. Fix by managing NAPI instances correctly.Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>Signed-off-by: David S. Miller <davem@davemloft.net>
1 parentdfb0555 commit76bb5db

File tree

2 files changed

+11
-7
lines changed

2 files changed

+11
-7
lines changed

‎drivers/net/hyperv/netvsc.c‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -584,8 +584,9 @@ void netvsc_device_remove(struct hv_device *device)
584584
/* Now, we can close the channel safely */
585585
vmbus_close(device->channel);
586586

587+
/* And dissassociate NAPI context from device */
587588
for (i=0;i<net_device->num_chn;i++)
588-
napi_disable(&net_device->chan_table[i].napi);
589+
netif_napi_del(&net_device->chan_table[i].napi);
589590

590591
/* Release all resources */
591592
free_netvsc_device_rcu(net_device);
@@ -1320,8 +1321,6 @@ int netvsc_device_add(struct hv_device *device,
13201321
structnetvsc_channel*nvchan=&net_device->chan_table[i];
13211322

13221323
nvchan->channel=device->channel;
1323-
netif_napi_add(ndev,&nvchan->napi,
1324-
netvsc_poll,NAPI_POLL_WEIGHT);
13251324
}
13261325

13271326
/* Open the channel */
@@ -1339,6 +1338,8 @@ int netvsc_device_add(struct hv_device *device,
13391338
netdev_dbg(ndev,"hv_netvsc channel opened successfully\n");
13401339

13411340
/* Enable NAPI handler for init callbacks */
1341+
netif_napi_add(ndev,&net_device->chan_table[0].napi,
1342+
netvsc_poll,NAPI_POLL_WEIGHT);
13421343
napi_enable(&net_device->chan_table[0].napi);
13431344

13441345
/* Writing nvdev pointer unlocks netvsc_send(), make sure chn_table is
@@ -1357,7 +1358,7 @@ int netvsc_device_add(struct hv_device *device,
13571358
returnret;
13581359

13591360
close:
1360-
napi_disable(&net_device->chan_table[0].napi);
1361+
netif_napi_del(&net_device->chan_table[0].napi);
13611362

13621363
/* Now, we can close the channel safely */
13631364
vmbus_close(device->channel);

‎drivers/net/hyperv/rndis_filter.c‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1009,13 +1009,16 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
10091009

10101010
/* Set the channel before opening.*/
10111011
nvchan->channel=new_sc;
1012+
netif_napi_add(ndev,&nvchan->napi,
1013+
netvsc_poll,NAPI_POLL_WEIGHT);
10121014

10131015
ret=vmbus_open(new_sc,nvscdev->ring_size*PAGE_SIZE,
10141016
nvscdev->ring_size*PAGE_SIZE,NULL,0,
10151017
netvsc_channel_cb,nvchan);
1016-
1017-
1018-
napi_enable(&nvchan->napi);
1018+
if (ret==0)
1019+
napi_enable(&nvchan->napi);
1020+
else
1021+
netdev_err(ndev,"sub channel open failed (%d)\n",ret);
10191022

10201023
if (refcount_dec_and_test(&nvscdev->sc_offered))
10211024
complete(&nvscdev->channel_init_wait);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp