diff options
| author | Antoine Tenart <[email protected]> | 2021-03-18 18:37:51 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2021-03-18 21:56:22 +0000 |
| commit | 2d05bf015308275f7c67a780f70026077285cfc0 (patch) | |
| tree | b73d016a2d2f6a8432ac2f6f04c0d971408723ac /drivers/net/wan/lapbether.c | |
| parent | net-sysfs: move the xps cpus/rxqs retrieval in a common function (diff) | |
| download | kernel-2d05bf015308275f7c67a780f70026077285cfc0.tar.gz kernel-2d05bf015308275f7c67a780f70026077285cfc0.zip | |
net: fix use after free in xps
When setting up an new dev_maps in __netif_set_xps_queue, we remove and
free maps from unused CPUs/rx-queues near the end of the function; by
calling remove_xps_queue. However it's possible those maps are also part
of the old not-freed-yet dev_maps, which might be used concurrently.
When that happens, a map can be freed while its corresponding entry in
the old dev_maps table isn't NULLed, leading to: "BUG: KASAN:
use-after-free" in different places.
This fixes the map freeing logic for unused CPUs/rx-queues, to also NULL
the map entries from the old dev_maps table.
Signed-off-by: Antoine Tenart <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'drivers/net/wan/lapbether.c')
0 files changed, 0 insertions, 0 deletions