lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 15 Dec 2019 11:41:39 -0800 From: Jakub Kicinski <jakub.kicinski@...ronome.com> To: Paul Durrant <pdurrant@...zon.com> Cc: <xen-devel@...ts.xenproject.org>, <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>, Juergen Gross <jgross@...e.com>, Wei Liu <wei.liu@...nel.org>, "David S. Miller" <davem@...emloft.net> Subject: Re: [PATCH net v2] xen-netback: avoid race that can lead to NULL pointer dereference On Fri, 13 Dec 2019 13:20:40 +0000, Paul Durrant wrote: > In function xenvif_disconnect_queue(), the value of queue->rx_irq is > zeroed *before* queue->task is stopped. Unfortunately that task may call > notify_remote_via_irq(queue->rx_irq) and calling that function with a > zero value results in a NULL pointer dereference in evtchn_from_irq(). > > This patch simply re-orders things, stopping all tasks before zero-ing the > irq values, thereby avoiding the possibility of the race. > > Fixes: 2ac061ce97f4 ("xen/netback: cleanup init and deinit code") > Signed-off-by: Paul Durrant <pdurrant@...zon.com> > v2: > - Add 'Fixes' tag and re-work commit comment I've added Wei's Ack from v1, if the code doesn't change substantially please keep people's Acks. Applied, thanks.
Powered by blists - more mailing lists