Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae9e63bb authored by Haiyang Zhang's avatar Haiyang Zhang Committed by David S. Miller
Browse files

hyperv: Move wait completion msg code into rndis_filter_halt_device() 



We need to wait for send_completion msg before put_rndis_request() at
the end of rndis_filter_halt_device(). Otherwise, netvsc_send_completion()
may reference freed memory which is overwritten, and cause panic.

Reported-by: default avatarLong Li <longli@microsoft.com>
Reported-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2207b60f

drivers/net/hyperv/netvsc.c

+0 −7
Original line number Diff line number Diff line
@@ -383,13 +383,6 @@ int netvsc_device_remove(struct hv_device *device) 
	unsigned long flags;



	net_device = hv_get_drvdata(device);

	spin_lock_irqsave(&device->channel->inbound_lock, flags);

	net_device->destroy = true;

	spin_unlock_irqrestore(&device->channel->inbound_lock, flags);



	/* Wait for all send completions */

	wait_event(net_device->wait_drain,

		   atomic_read(&net_device->num_outstanding_sends) == 0);



	netvsc_disconnect_vsp(net_device);

drivers/net/hyperv/rndis_filter.c

+11 −0
Original line number Diff line number Diff line
@@ -718,6 +718,9 @@ static void rndis_filter_halt_device(struct rndis_device *dev) 
{

	struct rndis_request *request;

	struct rndis_halt_request *halt;

	struct netvsc_device *nvdev = dev->net_dev;

	struct hv_device *hdev = nvdev->dev;

	ulong flags;



	/* Attempt to do a rndis device halt */

	request = get_rndis_request(dev, RNDIS_MSG_HALT,
@@ -735,6 +738,14 @@ static void rndis_filter_halt_device(struct rndis_device *dev) 
	dev->state = RNDIS_DEV_UNINITIALIZED;



cleanup:

	spin_lock_irqsave(&hdev->channel->inbound_lock, flags);

	nvdev->destroy = true;

	spin_unlock_irqrestore(&hdev->channel->inbound_lock, flags);



	/* Wait for all send completions */

	wait_event(nvdev->wait_drain,

		atomic_read(&nvdev->num_outstanding_sends) == 0);



	if (request)

		put_rndis_request(dev, request);

	return;