diff options
| author |   Antoine Tenart <atenart@kernel.org> | 2021-03-18 19:37:51 +0100 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2021-03-18 14:56:22 -0700 |
| commit | 2d05bf015308275f7c67a780f70026077285cfc0 (patch) | |
| tree | b73d016a2d2f6a8432ac2f6f04c0d971408723ac /drivers/net/ethernet/intel/ice/ice_flex_pipe.c | |
| parent | net-sysfs: move the xps cpus/rxqs retrieval in a common function (diff) | |
| download | linux-dev-2d05bf015308275f7c67a780f70026077285cfc0.tar.xz linux-dev-2d05bf015308275f7c67a780f70026077285cfc0.zip | |
net: fix use after free in xps
When setting up an new dev_maps in __netif_set_xps_queue, we remove and
free maps from unused CPUs/rx-queues near the end of the function; by
calling remove_xps_queue. However it's possible those maps are also part
of the old not-freed-yet dev_maps, which might be used concurrently.
When that happens, a map can be freed while its corresponding entry in
the old dev_maps table isn't NULLed, leading to: "BUG: KASAN:
use-after-free" in different places.
This fixes the map freeing logic for unused CPUs/rx-queues, to also NULL
the map entries from the old dev_maps table.
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/intel/ice/ice_flex_pipe.c')
0 files changed, 0 insertions, 0 deletions