diff options
author | Jakub Kicinski <jakub.kicinski@netronome.com> | 2017-04-04 18:56:55 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2017-04-05 21:46:40 -0400 |
commit | c383bdd14f91562babd269aa7c36b46fee7b6c75 (patch) | |
tree | f46a23718a949591f4161dadc902368452d7858f | |
parent | 2d2517ee314ef1de0517f74d06c2825fbf597ba3 (diff) |
nfp: fix potential use after free on xdp prog
We should unregister the net_device first, before we give back
our reference on xdp_prog. Otherwise xdp_prog may be freed
before .ndo_stop() disabled the datapath. Found by code inspection.
Fixes: ecd63a0217d5 ("nfp: add XDP support in the driver")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c index 9179a99563af..a41377e26c07 100644 --- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c | |||
@@ -3275,9 +3275,10 @@ void nfp_net_netdev_clean(struct net_device *netdev) | |||
3275 | { | 3275 | { |
3276 | struct nfp_net *nn = netdev_priv(netdev); | 3276 | struct nfp_net *nn = netdev_priv(netdev); |
3277 | 3277 | ||
3278 | unregister_netdev(nn->netdev); | ||
3279 | |||
3278 | if (nn->xdp_prog) | 3280 | if (nn->xdp_prog) |
3279 | bpf_prog_put(nn->xdp_prog); | 3281 | bpf_prog_put(nn->xdp_prog); |
3280 | if (nn->bpf_offload_xdp) | 3282 | if (nn->bpf_offload_xdp) |
3281 | nfp_net_xdp_offload(nn, NULL); | 3283 | nfp_net_xdp_offload(nn, NULL); |
3282 | unregister_netdev(nn->netdev); | ||
3283 | } | 3284 | } |