* [PATCH net] mctp: serial: Cancel pending work from ndo_uninit handler
@ 2022-02-11 1:15 Jeremy Kerr
2022-02-11 22:50 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: Jeremy Kerr @ 2022-02-11 1:15 UTC (permalink / raw)
To: netdev; +Cc: Matt Johnston, David S. Miller, Jakub Kicinski
We cannot do the cancel_work_sync from after the unregister_netdev, as
the dev pointer is no longer valid, causing a uaf on ldisc unregister
(or device close).
Instead, do the cancel_work_sync from the ndo_uninit op, where the dev
still exists, but the queue has stopped.
Fixes: 7bd9890f3d74 ("mctp: serial: cancel tx work on ldisc close")
Reported-by: Luo Likang <luolikang@nsfocus.com>
Tested-by: Luo Likang <luolikang@nsfocus.com>
Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
---
drivers/net/mctp/mctp-serial.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/mctp/mctp-serial.c b/drivers/net/mctp/mctp-serial.c
index eaa6fb3224bc..62723a7faa2d 100644
--- a/drivers/net/mctp/mctp-serial.c
+++ b/drivers/net/mctp/mctp-serial.c
@@ -403,8 +403,16 @@ static void mctp_serial_tty_receive_buf(struct tty_struct *tty,
mctp_serial_push(dev, c[i]);
}
+static void mctp_serial_uninit(struct net_device *ndev)
+{
+ struct mctp_serial *dev = netdev_priv(ndev);
+
+ cancel_work_sync(&dev->tx_work);
+}
+
static const struct net_device_ops mctp_serial_netdev_ops = {
.ndo_start_xmit = mctp_serial_tx,
+ .ndo_uninit = mctp_serial_uninit,
};
static void mctp_serial_setup(struct net_device *ndev)
@@ -483,7 +491,6 @@ static void mctp_serial_close(struct tty_struct *tty)
int idx = dev->idx;
unregister_netdev(dev->netdev);
- cancel_work_sync(&dev->tx_work);
ida_free(&mctp_serial_ida, idx);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] mctp: serial: Cancel pending work from ndo_uninit handler
2022-02-11 1:15 [PATCH net] mctp: serial: Cancel pending work from ndo_uninit handler Jeremy Kerr
@ 2022-02-11 22:50 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-02-11 22:50 UTC (permalink / raw)
To: Jeremy Kerr; +Cc: netdev, matt, davem, kuba
Hello:
This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 11 Feb 2022 09:15:52 +0800 you wrote:
> We cannot do the cancel_work_sync from after the unregister_netdev, as
> the dev pointer is no longer valid, causing a uaf on ldisc unregister
> (or device close).
>
> Instead, do the cancel_work_sync from the ndo_uninit op, where the dev
> still exists, but the queue has stopped.
>
> [...]
Here is the summary with links:
- [net] mctp: serial: Cancel pending work from ndo_uninit handler
https://git.kernel.org/netdev/net/c/6c342ce2239c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-02-11 22:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-11 1:15 [PATCH net] mctp: serial: Cancel pending work from ndo_uninit handler Jeremy Kerr
2022-02-11 22:50 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.