Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1591146 > unrolled thread
| Started by | Dexuan Cui <decui@microsoft.com> |
|---|---|
| First post | 2017-03-02 15:50 +0100 |
| Last post | 2017-03-03 01:50 +0100 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH] netvsc: fix use-after-free in netvsc_change_mtu() Dexuan Cui <decui@microsoft.com> - 2017-03-02 15:50 +0100
Re: [PATCH] netvsc: fix use-after-free in netvsc_change_mtu() Stephen Hemminger <stephen@networkplumber.org> - 2017-03-02 19:20 +0100
Re: [PATCH] netvsc: fix use-after-free in netvsc_change_mtu() David Miller <davem@davemloft.net> - 2017-03-03 01:50 +0100
| From | Dexuan Cui <decui@microsoft.com> |
|---|---|
| Date | 2017-03-02 15:50 +0100 |
| Subject | [PATCH] netvsc: fix use-after-free in netvsc_change_mtu() |
| Message-ID | <tgAdk-3As-23@gated-at.bofh.it> |
'nvdev' is freed in rndis_filter_device_remove -> netvsc_device_remove -> free_netvsc_device, so we mustn't access it, before it's re-created in rndis_filter_device_add -> netvsc_device_add. Signed-off-by: Dexuan Cui <decui@microsoft.com> Cc: "K. Y. Srinivasan" <kys@microsoft.com> Cc: Haiyang Zhang <haiyangz@microsoft.com> Cc: Stephen Hemminger <sthemmin@microsoft.com> --- drivers/net/hyperv/netvsc_drv.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c index 2d3cdb0..bc05c89 100644 --- a/drivers/net/hyperv/netvsc_drv.c +++ b/drivers/net/hyperv/netvsc_drv.c @@ -859,15 +859,22 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) if (ret) goto out; + memset(&device_info, 0, sizeof(device_info)); + device_info.ring_size = ring_size; + device_info.num_chn = nvdev->num_chn; + device_info.max_num_vrss_chns = nvdev->num_chn; + ndevctx->start_remove = true; rndis_filter_device_remove(hdev, nvdev); + /* 'nvdev' has been freed in rndis_filter_device_remove() -> + * netvsc_device_remove () -> free_netvsc_device(). + * We mustn't access it before it's re-created in + * rndis_filter_device_add() -> netvsc_device_add(). + */ + ndev->mtu = mtu; - memset(&device_info, 0, sizeof(device_info)); - device_info.ring_size = ring_size; - device_info.num_chn = nvdev->num_chn; - device_info.max_num_vrss_chns = nvdev->num_chn; rndis_filter_device_add(hdev, &device_info); out: -- 2.7.4
[toc] | [next] | [standalone]
| From | Stephen Hemminger <stephen@networkplumber.org> |
|---|---|
| Date | 2017-03-02 19:20 +0100 |
| Message-ID | <tgDuy-67m-15@gated-at.bofh.it> |
| In reply to | #1591146 |
On Thu, 2 Mar 2017 13:00:53 +0000 Dexuan Cui <decui@microsoft.com> wrote: > 'nvdev' is freed in rndis_filter_device_remove -> netvsc_device_remove -> > free_netvsc_device, so we mustn't access it, before it's re-created in > rndis_filter_device_add -> netvsc_device_add. > > Signed-off-by: Dexuan Cui <decui@microsoft.com> > Cc: "K. Y. Srinivasan" <kys@microsoft.com> > Cc: Haiyang Zhang <haiyangz@microsoft.com> > Cc: Stephen Hemminger <sthemmin@microsoft.com> Reviewed-by: Stephen Hemminger <sthemmin@microsoft.com>
[toc] | [prev] | [next] | [standalone]
| From | David Miller <davem@davemloft.net> |
|---|---|
| Date | 2017-03-03 01:50 +0100 |
| Message-ID | <tgJzY-1FS-7@gated-at.bofh.it> |
| In reply to | #1591146 |
From: Dexuan Cui <decui@microsoft.com> Date: Thu, 2 Mar 2017 13:00:53 +0000 > 'nvdev' is freed in rndis_filter_device_remove -> netvsc_device_remove -> > free_netvsc_device, so we mustn't access it, before it's re-created in > rndis_filter_device_add -> netvsc_device_add. > > Signed-off-by: Dexuan Cui <decui@microsoft.com> Applied.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web