| Message ID | 20230420140157.22416-1-duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Rejected |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] ethernet: ixgb: fix use after free bugs caused by circular dependency problem | expand |
On Thu, 20 Apr 2023 22:01:57 +0800 Duoming Zhou wrote: > The watchdog_timer can schedule tx_timeout_task and tx_timeout_task > can also arm watchdog_timer. The process is shown below: > > ----------- timer schedules work ------------ > ixgb_watchdog() //timer handler > schedule_work(&adapter->tx_timeout_task) > > ----------- work arms timer ------------ > ixgb_tx_timeout_task() //workqueue callback function > ixgb_up() > mod_timer(&adapter->watchdog_timer,...) > > When ixgb device is detaching, the timer and workqueue > could still be rearmed. The process is shown below: > > (cleanup routine) | (timer and workqueue routine) > ixgb_remove() | > | ixgb_tx_timeout_task() //workqueue > | ixgb_up() > | mod_timer() > cancel_work_sync() | > free_netdev(netdev) //FREE | ixgb_watchdog() //timer > | netif_carrier_ok(netdev) //USE > > This patch adds timer_shutdown_sync() in ixgb_remove(), which > could prevent rearming of the timer from the workqueue. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> The driver has been removed. No point.
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c index b4d47e7a76c..6ce3601904b 100644 --- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c +++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c @@ -516,6 +516,7 @@ ixgb_remove(struct pci_dev *pdev) struct net_device *netdev = pci_get_drvdata(pdev); struct ixgb_adapter *adapter = netdev_priv(netdev); + timer_shutdown_sync(&adapter->watchdog_timer); cancel_work_sync(&adapter->tx_timeout_task); unregister_netdev(netdev);
The watchdog_timer can schedule tx_timeout_task and tx_timeout_task can also arm watchdog_timer. The process is shown below: ----------- timer schedules work ------------ ixgb_watchdog() //timer handler schedule_work(&adapter->tx_timeout_task) ----------- work arms timer ------------ ixgb_tx_timeout_task() //workqueue callback function ixgb_up() mod_timer(&adapter->watchdog_timer,...) When ixgb device is detaching, the timer and workqueue could still be rearmed. The process is shown below: (cleanup routine) | (timer and workqueue routine) ixgb_remove() | | ixgb_tx_timeout_task() //workqueue | ixgb_up() | mod_timer() cancel_work_sync() | free_netdev(netdev) //FREE | ixgb_watchdog() //timer | netif_carrier_ok(netdev) //USE This patch adds timer_shutdown_sync() in ixgb_remove(), which could prevent rearming of the timer from the workqueue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- drivers/net/ethernet/intel/ixgb/ixgb_main.c | 1 + 1 file changed, 1 insertion(+)