Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 152669bd authored by Dexuan Cui's avatar Dexuan Cui Committed by David S. Miller
Browse files

netvsc: fix use-after-free in netvsc_change_mtu() 



'nvdev' is freed in rndis_filter_device_remove -> netvsc_device_remove ->
free_netvsc_device, so we mustn't access it, before it's re-created in
rndis_filter_device_add -> netvsc_device_add.

Signed-off-by: default avatarDexuan Cui <decui@microsoft.com>
Cc: "K. Y. Srinivasan" <kys@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Reviewed-by: default avatarStephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 35576ee1

drivers/net/hyperv/netvsc_drv.c

+11 −4
Original line number Diff line number Diff line
@@ -859,15 +859,22 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) 
	if (ret)

		goto out;



	memset(&device_info, 0, sizeof(device_info));

	device_info.ring_size = ring_size;

	device_info.num_chn = nvdev->num_chn;

	device_info.max_num_vrss_chns = nvdev->num_chn;



	ndevctx->start_remove = true;

	rndis_filter_device_remove(hdev, nvdev);



	/* 'nvdev' has been freed in rndis_filter_device_remove() ->

	 * netvsc_device_remove () -> free_netvsc_device().

	 * We mustn't access it before it's re-created in

	 * rndis_filter_device_add() -> netvsc_device_add().

	 */



	ndev->mtu = mtu;



	memset(&device_info, 0, sizeof(device_info));

	device_info.ring_size = ring_size;

	device_info.num_chn = nvdev->num_chn;

	device_info.max_num_vrss_chns = nvdev->num_chn;

	rndis_filter_device_add(hdev, &device_info);



out: