xen-netfront: properly destroy queues when removing device

Browse source

commit ad06811857 upstream.

xennet_remove() freed the queues before freeing the netdevice which
results in a use-after-free when free_netdev() tries to delete the
napi instances that have already been freed.

Fix this by fully destroy the queues (which includes deleting the napi
instances) before freeing the netdevice.

Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: I already backported most of this along with
 the later commit 7447095485 "xen-netfront: Delete rx_refill_timer in
  xennet_disconnect_backend()"; don't move the del_timer_sync() again.]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

...

This commit is contained in:

David Vrabel 2015-05-27 15:46:10 +01:00 • committed by Ben Hutchings

parent c65cad893f

commit a07703b41b

1 changed files with 1 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

drivers/net/xen-netfront.c

View file