Unverified Commit 5070ad28 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12744 net/xen-netback: prevent UAF in xenvif_flush_hash() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Luo Gengkun <luogengkun2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6NZMKU4KZ5TK6KXL546ZJRUFHWSMHXKC/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYRB6 
 
Link:https://gitee.com/openeuler/kernel/pulls/12744

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 6a982c80 e6e61480

drivers/net/xen-netback/hash.c

+2 −3
Original line number Diff line number Diff line
@@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data, 


static void xenvif_flush_hash(struct xenvif *vif)

{

	struct xenvif_hash_cache_entry *entry;

	struct xenvif_hash_cache_entry *entry, *n;

	unsigned long flags;



	if (xenvif_hash_cache_size == 0)
@@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif) 


	spin_lock_irqsave(&vif->hash.cache.lock, flags);



	list_for_each_entry_rcu(entry, &vif->hash.cache.list, link,

				lockdep_is_held(&vif->hash.cache.lock)) {

	list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) {

		list_del_rcu(&entry->link);

		vif->hash.cache.count--;

		kfree_rcu(entry, rcu);