Messages in this thread | | | From | Zheng Hacker <> | Date | Tue, 14 Mar 2023 10:12:10 +0800 | Subject | Re: [PATCH v2] xirc2ps_cs: Fix use after free bug in xirc2ps_detach |
| |
Jakub Kicinski <kuba@kernel.org> 于2023年3月14日周二 08:15写道: > > On Sun, 12 Mar 2023 01:08:36 +0800 Zheng Wang wrote: > > In xirc2ps_probe, the local->tx_timeout_task was bounded > > with xirc2ps_tx_timeout_task. When timeout occurs, > > it will call xirc_tx_timeout->schedule_work to start the > > work. > > > > When we call xirc2ps_detach to remove the driver, there > > may be a sequence as follows: > > > > Stop responding to timeout tasks and complete scheduled > > tasks before cleanup in xirc2ps_detach, which will fix > > the problem. > > > > CPU0 CPU1 > > > > |xirc2ps_tx_timeout_task > > xirc2ps_detach | > > free_netdev | > > kfree(dev); | > > | > > | do_reset > > | //use dev > > > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > > Signed-off-by: Zheng Wang <zyytlz.wz@163.com> > > --- > > v2: > > - fix indentation error suggested by Simon Horman, > > and stop the timeout tasks suggested by Yunsheng Lin > > --- > > drivers/net/ethernet/xircom/xirc2ps_cs.c | 5 +++++ > > 1 file changed, 5 insertions(+) > > > > diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c b/drivers/net/ethernet/xircom/xirc2ps_cs.c > > index 894e92ef415b..c77ca11d9497 100644 > > --- a/drivers/net/ethernet/xircom/xirc2ps_cs.c > > +++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c > > @@ -503,6 +503,11 @@ static void > > xirc2ps_detach(struct pcmcia_device *link) > > { > > struct net_device *dev = link->priv; > > + struct local_info *local = netdev_priv(dev); > > + > > + netif_carrier_off(dev); > > + netif_tx_disable(dev); > > + cancel_work_sync(&local->tx_timeout_task); > > > > dev_dbg(&link->dev, "detach\n"); > > > > Please fix the formatting and make sure you CC the maintainers when you > post v3.
Hi Jakub,
Get it!
Best regards, Zheng
| |