| Message ID | 20220211011552.1861886-1-jk@codeconstruct.com.au (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 6c342ce2239c182c2428ce5a44cb32330434ae6e |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] mctp: serial: Cancel pending work from ndo_uninit handler | expand |
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Fri, 11 Feb 2022 09:15:52 +0800 you wrote: > We cannot do the cancel_work_sync from after the unregister_netdev, as > the dev pointer is no longer valid, causing a uaf on ldisc unregister > (or device close). > > Instead, do the cancel_work_sync from the ndo_uninit op, where the dev > still exists, but the queue has stopped. > > [...] Here is the summary with links: - [net] mctp: serial: Cancel pending work from ndo_uninit handler https://git.kernel.org/netdev/net/c/6c342ce2239c You are awesome, thank you!
diff --git a/drivers/net/mctp/mctp-serial.c b/drivers/net/mctp/mctp-serial.c index eaa6fb3224bc..62723a7faa2d 100644 --- a/drivers/net/mctp/mctp-serial.c +++ b/drivers/net/mctp/mctp-serial.c @@ -403,8 +403,16 @@ static void mctp_serial_tty_receive_buf(struct tty_struct *tty, mctp_serial_push(dev, c[i]); } +static void mctp_serial_uninit(struct net_device *ndev) +{ + struct mctp_serial *dev = netdev_priv(ndev); + + cancel_work_sync(&dev->tx_work); +} + static const struct net_device_ops mctp_serial_netdev_ops = { .ndo_start_xmit = mctp_serial_tx, + .ndo_uninit = mctp_serial_uninit, }; static void mctp_serial_setup(struct net_device *ndev) @@ -483,7 +491,6 @@ static void mctp_serial_close(struct tty_struct *tty) int idx = dev->idx; unregister_netdev(dev->netdev); - cancel_work_sync(&dev->tx_work); ida_free(&mctp_serial_ida, idx); }
We cannot do the cancel_work_sync from after the unregister_netdev, as the dev pointer is no longer valid, causing a uaf on ldisc unregister (or device close). Instead, do the cancel_work_sync from the ndo_uninit op, where the dev still exists, but the queue has stopped. Fixes: 7bd9890f3d74 ("mctp: serial: cancel tx work on ldisc close") Reported-by: Luo Likang <luolikang@nsfocus.com> Tested-by: Luo Likang <luolikang@nsfocus.com> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> --- drivers/net/mctp/mctp-serial.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)