Thread (1 message) flat view 1 message, 1 author, 2014-10-06
STALE4323d REVIEWED: 1 (0M)

Revision v2 of 5 in this series; 1 review trailer.

Revisions (5)
  1. v1 [diff vs current]
  2. v2 current
  3. v2 [diff vs current]
  4. v3 [diff vs current]
  5. v4 [diff vs current]

[PATCH v2 15/15] virtio_net: fix use after free on allocation failure

From: "Michael S. Tsirkin" <mst@redhat.com>
Date: 2014-10-06 15:08:16
Also in: kvm, lkml
Subsystem: networking drivers, the rest, virtio net driver · Maintainers: Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds, "Michael S. Tsirkin", Jason Wang

In the extremely unlikely event that driver initialization fails after
RX buffers are added, virtio net frees RX buffers while VQs are
still active, potentially causing device to use a freed buffer.

To fix, reset device first - same as we do on device removal.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Cornelia Huck <redacted>
---
 drivers/net/virtio_net.c | 2 ++
 1 file changed, 2 insertions(+)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 430f3ae..3551417 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1830,6 +1830,8 @@ static int virtnet_probe(struct virtio_device *vdev)
 	return 0;
 
 free_recv_bufs:
+	vi->vdev->config->reset(vdev);
+
 	free_receive_bufs(vi);
 	unregister_netdev(dev);
 free_vqs:
-- 
MST
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help