Unverified Commit 3437d157 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12743 net/xen-netback: prevent UAF in xenvif_flush_hash() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Luo Gengkun <luogengkun2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5E7DI2JQK34NPTZTDZLMSK24SNVQH6EA/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYRB6 
 
Link:https://gitee.com/openeuler/kernel/pulls/12743

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents f87c69ac 20db162f

drivers/net/xen-netback/hash.c

+2 −2
Original line number Diff line number Diff line
@@ -94,7 +94,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data, 


static void xenvif_flush_hash(struct xenvif *vif)

{

	struct xenvif_hash_cache_entry *entry;

	struct xenvif_hash_cache_entry *entry, *n;

	unsigned long flags;



	if (xenvif_hash_cache_size == 0)
@@ -102,7 +102,7 @@ static void xenvif_flush_hash(struct xenvif *vif) 


	spin_lock_irqsave(&vif->hash.cache.lock, flags);



	list_for_each_entry_rcu(entry, &vif->hash.cache.list, link) {

	list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) {

		list_del_rcu(&entry->link);

		vif->hash.cache.count--;

		kfree_rcu(entry, rcu);