lkml.org 
[lkml]   [2018]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] net: thunderx: prevent concurrent data re-writing by nicvf_set_rx_mode
From
From: Vadim Lomovtsev <Vadim.Lomovtsev@caviumnetworks.com>
Date: Fri, 8 Jun 2018 02:27:59 -0700

> + /* Save message data locally to prevent them from
> + * being overwritten by next ndo_set_rx_mode call().
> + */
> + spin_lock(&nic->rx_mode_wq_lock);
> + mode = vf_work->mode;
> + mc = vf_work->mc;
> + vf_work->mc = NULL;
> + spin_unlock(&nic->rx_mode_wq_lock);

At the moment you drop this lock, the memory behind 'mc' can be
freed up by:

> + spin_lock(&nic->rx_mode_wq_lock);
> + kfree(nic->rx_mode_work.mc);

And you'll crash when you dereference it above via
__nicvf_set_rx_mode_task().

\
 
 \ /
  Last update: 2018-06-10 21:36    [W:0.198 / U:0.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site