Commit ad068118 authored by David Vrabel's avatar David Vrabel Committed by David S. Miller

xen-netfront: properly destroy queues when removing device

xennet_remove() freed the queues before freeing the netdevice which
results in a use-after-free when free_netdev() tries to delete the
napi instances that have already been freed.

Fix this by fully destroy the queues (which includes deleting the napi
instances) before freeing the netdevice.
Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
Reviewed-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f4ecf29f
...@@ -1698,6 +1698,7 @@ static void xennet_destroy_queues(struct netfront_info *info) ...@@ -1698,6 +1698,7 @@ static void xennet_destroy_queues(struct netfront_info *info)
if (netif_running(info->netdev)) if (netif_running(info->netdev))
napi_disable(&queue->napi); napi_disable(&queue->napi);
del_timer_sync(&queue->rx_refill_timer);
netif_napi_del(&queue->napi); netif_napi_del(&queue->napi);
} }
...@@ -2102,9 +2103,6 @@ static const struct attribute_group xennet_dev_group = { ...@@ -2102,9 +2103,6 @@ static const struct attribute_group xennet_dev_group = {
static int xennet_remove(struct xenbus_device *dev) static int xennet_remove(struct xenbus_device *dev)
{ {
struct netfront_info *info = dev_get_drvdata(&dev->dev); struct netfront_info *info = dev_get_drvdata(&dev->dev);
unsigned int num_queues = info->netdev->real_num_tx_queues;
struct netfront_queue *queue = NULL;
unsigned int i = 0;
dev_dbg(&dev->dev, "%s\n", dev->nodename); dev_dbg(&dev->dev, "%s\n", dev->nodename);
...@@ -2112,16 +2110,7 @@ static int xennet_remove(struct xenbus_device *dev) ...@@ -2112,16 +2110,7 @@ static int xennet_remove(struct xenbus_device *dev)
unregister_netdev(info->netdev); unregister_netdev(info->netdev);
for (i = 0; i < num_queues; ++i) { xennet_destroy_queues(info);
queue = &info->queues[i];
del_timer_sync(&queue->rx_refill_timer);
}
if (num_queues) {
kfree(info->queues);
info->queues = NULL;
}
xennet_free_netdev(info->netdev); xennet_free_netdev(info->netdev);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment