github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

xen-netback: defer xenvif_mcast_addr_list_free()

Browse Source 
In order for the function to legitimately avoid locking/RCU, it needs to
run after all TX/RX processing has finished/stopped: Lookups happen from
xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()
(called out of xenvif_poll()).

Move the call out of xenvif_disconnect_data() (the call to the function
from connect()'s error path doesn't require any cleaning up there), and
put it past the synchronization point in backend_disconnect().

This is XSA-527 / CVE-2026-100081.

Fixes: b17075d5c1 ("xen-netback: fix race condition on XenBus disconnect")
Reported-by: kerhunt <kerhunt@proton.me>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
This commit is contained in:
Jan Beulich 2026-11-06 17:07:01 +01:00 committed by Juergen Gross
parent 5fb756f1bb
commit bfddc420af
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/xen-netback/interface.c
View File

@ -812,8 +812,6 @@ void xenvif_disconnect_data(struct xenvif *vif)
xenvif_disconnect_queue(queue);
}
xenvif_mcast_addr_list_free(vif);
}
void xenvif_disconnect_ctrl(struct xenvif *vif)

2
drivers/net/xen-netback/xenbus.c
View File

@ -267,6 +267,8 @@ static void backend_disconnect(struct backend_info *be)
vif->num_queues = 0;
synchronize_net();
xenvif_mcast_addr_list_free(vif);
for (queue_index = 0; queue_index < num_queues; ++queue_index)
xenvif_deinit_queue(&vif->queues[queue_index]);