Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1656881

Re: [PATCH net] net: dsa: Fix stale cpu_switch reference after unbind then bind

Show all headers | View raw

Hi Florian,

Florian Fainelli <f.fainelli@gmail.com> writes:

> Commit 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]")
> replaced the use of dst->ds[0] with dst->cpu_switch since that is
> functionally equivalent, however, we can now run into an use after free
> scenario after unbinding then rebinding the switch driver.
>
> The use after free happens because we do correctly initialize
> dst->cpu_switch the first time we probe in dsa_cpu_parse(), then we
> unbind the driver: dsa_dst_unapply() is called, and we rebind again.
> dst->cpu_switch now points to a freed "ds" structure, and so when we
> finally dereference it in dsa_cpu_port_ethtool_setup(), we oops.
>
> To fix this, simply set dst->cpu_switch to NULL in dsa_dst_unapply()
> which guarantees that we always correctly re-assign dst->cpu_switch in
> dsa_cpu_parse().
>
> Fixes: 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]")
> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>

Reviewed-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>

Thanks!

        Vivien

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH net] net: dsa: Fix stale cpu_switch reference after unbind then bind Florian Fainelli <f.fainelli@gmail.com> - 2017-06-03 07:10 +0200
  Re: [PATCH net] net: dsa: Fix stale cpu_switch reference after unbind then bind Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-06-03 20:00 +0200
  Re: [PATCH net] net: dsa: Fix stale cpu_switch reference after  unbind then bind David Miller <davem@davemloft.net> - 2017-06-05 05:00 +0200

csiph-web