Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d212b463 authored by Haiyang Zhang's avatar Haiyang Zhang Committed by David S. Miller
Browse files

hv_netvsc: Fix accessing freed memory in netvsc_change_mtu() 



struct netvsc_device is freed in rndis_filter_device_remove(). So we save
the nvdev->num_chn into a temp variable for later usage.

(Please also include this patch into stable branch.)

Signed-off-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1f461dcd

drivers/net/hyperv/netvsc_drv.c

+4 −1
Original line number Diff line number Diff line
@@ -858,6 +858,7 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) 
	struct netvsc_device *nvdev = hv_get_drvdata(hdev);

	struct netvsc_device_info device_info;

	int limit = ETH_DATA_LEN;

	u32 num_chn;

	int ret = 0;



	if (nvdev == NULL || nvdev->destroy)
@@ -873,6 +874,8 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) 
	if (ret)

		goto out;



	num_chn = nvdev->num_chn;



	nvdev->start_remove = true;

	rndis_filter_device_remove(hdev);
@@ -883,7 +886,7 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) 


	memset(&device_info, 0, sizeof(device_info));

	device_info.ring_size = ring_size;

	device_info.num_chn = nvdev->num_chn;

	device_info.num_chn = num_chn;

	device_info.max_num_vrss_chns = max_num_vrss_chns;

	rndis_filter_device_add(hdev, &device_info);