Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1591146 > unrolled thread

[PATCH] netvsc: fix use-after-free in netvsc_change_mtu()

Started byDexuan Cui <decui@microsoft.com>
First post2017-03-02 15:50 +0100
Last post2017-03-03 01:50 +0100
Articles 3 — 3 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH] netvsc: fix use-after-free in netvsc_change_mtu() Dexuan Cui <decui@microsoft.com> - 2017-03-02 15:50 +0100
    Re: [PATCH] netvsc: fix use-after-free in netvsc_change_mtu() Stephen Hemminger <stephen@networkplumber.org> - 2017-03-02 19:20 +0100
    Re: [PATCH] netvsc: fix use-after-free in netvsc_change_mtu() David Miller <davem@davemloft.net> - 2017-03-03 01:50 +0100

#1591146 — [PATCH] netvsc: fix use-after-free in netvsc_change_mtu()

FromDexuan Cui <decui@microsoft.com>
Date2017-03-02 15:50 +0100
Subject[PATCH] netvsc: fix use-after-free in netvsc_change_mtu()
Message-ID<tgAdk-3As-23@gated-at.bofh.it>
'nvdev' is freed in rndis_filter_device_remove -> netvsc_device_remove ->
free_netvsc_device, so we mustn't access it, before it's re-created in
rndis_filter_device_add -> netvsc_device_add.

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Cc: "K. Y. Srinivasan" <kys@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
---
 drivers/net/hyperv/netvsc_drv.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 2d3cdb0..bc05c89 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -859,15 +859,22 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
 	if (ret)
 		goto out;
 
+	memset(&device_info, 0, sizeof(device_info));
+	device_info.ring_size = ring_size;
+	device_info.num_chn = nvdev->num_chn;
+	device_info.max_num_vrss_chns = nvdev->num_chn;
+
 	ndevctx->start_remove = true;
 	rndis_filter_device_remove(hdev, nvdev);
 
+	/* 'nvdev' has been freed in rndis_filter_device_remove() ->
+	 * netvsc_device_remove () -> free_netvsc_device().
+	 * We mustn't access it before it's re-created in
+	 * rndis_filter_device_add() -> netvsc_device_add().
+	 */
+
 	ndev->mtu = mtu;
 
-	memset(&device_info, 0, sizeof(device_info));
-	device_info.ring_size = ring_size;
-	device_info.num_chn = nvdev->num_chn;
-	device_info.max_num_vrss_chns = nvdev->num_chn;
 	rndis_filter_device_add(hdev, &device_info);
 
 out:
-- 
2.7.4

[toc] | [next] | [standalone]


#1591377

FromStephen Hemminger <stephen@networkplumber.org>
Date2017-03-02 19:20 +0100
Message-ID<tgDuy-67m-15@gated-at.bofh.it>
In reply to#1591146
On Thu, 2 Mar 2017 13:00:53 +0000
Dexuan Cui <decui@microsoft.com> wrote:

> 'nvdev' is freed in rndis_filter_device_remove -> netvsc_device_remove ->
> free_netvsc_device, so we mustn't access it, before it's re-created in
> rndis_filter_device_add -> netvsc_device_add.
> 
> Signed-off-by: Dexuan Cui <decui@microsoft.com>
> Cc: "K. Y. Srinivasan" <kys@microsoft.com>
> Cc: Haiyang Zhang <haiyangz@microsoft.com>
> Cc: Stephen Hemminger <sthemmin@microsoft.com>

Reviewed-by: Stephen Hemminger <sthemmin@microsoft.com>

[toc] | [prev] | [next] | [standalone]


#1591585

FromDavid Miller <davem@davemloft.net>
Date2017-03-03 01:50 +0100
Message-ID<tgJzY-1FS-7@gated-at.bofh.it>
In reply to#1591146
From: Dexuan Cui <decui@microsoft.com>
Date: Thu, 2 Mar 2017 13:00:53 +0000

> 'nvdev' is freed in rndis_filter_device_remove -> netvsc_device_remove ->
> free_netvsc_device, so we mustn't access it, before it's re-created in
> rndis_filter_device_add -> netvsc_device_add.
> 
> Signed-off-by: Dexuan Cui <decui@microsoft.com>

Applied.

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web