• Nikolay Aleksandrov's avatar
    netconsole: fix NULL pointer dereference · 45e526e8
    Nikolay Aleksandrov authored
    We need to disable the netconsole (enabled = 0) before setting nt->np.dev
    to NULL because otherwise we might still have users after the
    netpoll_cleanup() since nt->enabled is set afterwards and we can
    have a message which will result in a NULL pointer dereference.
    It is very easy to hit dereferences all over the netpoll_send_udp function
    by running the following two loops in parallel:
    while [ 1 ]; do echo 1 > enabled; echo 0 > enabled; done;
    while [ 1 ]; do echo 00:11:22:33:44:55 > remote_mac; done;
    (the second loop is to generate messages, it can be done by anything)
    
    We're safe to set nt->np.dev = NULL and nt->enabled = 0 with the spinlock
    since it's required in the write_msg() function.
    Signed-off-by: default avatarNikolay Aleksandrov <nikolay@redhat.com>
    Reviewed-by: default avatarVeacelsav Falico <vfalico@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    45e526e8
netconsole.c 21.7 KB