lkml.org 
[lkml]   [2019]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] net: nvidia: forcedeth: Fix two possible concurrency use-after-free bugs
From
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Tue, 8 Jan 2019 20:45:18 +0800

> In drivers/net/ethernet/nvidia/forcedeth.c, the functions
> nv_start_xmit() and nv_start_xmit_optimized() can be concurrently
> executed with nv_poll_controller().
>
> nv_start_xmit
> line 2321: prev_tx_ctx->skb = skb;
>
> nv_start_xmit_optimized
> line 2479: prev_tx_ctx->skb = skb;
>
> nv_poll_controller
> nv_do_nic_poll
> line 4134: spin_lock(&np->lock);
> nv_drain_rxtx
> nv_drain_tx
> nv_release_txskb
> line 2004: dev_kfree_skb_any(tx_skb->skb);
>
> Thus, two possible concurrency use-after-free bugs may occur.

I do not think so, the netif_tx_lock_bh() done will prevent the parallel
execution.

\
 
 \ /
  Last update: 2019-01-12 02:54    [W:0.053 / U:26.512 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site