From bfddc420afe827d9f06458cdf8087cd602f8c9cb Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Fri, 6 Nov 2026 17:07:01 +0100 Subject: [PATCH] xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()). Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect(). This is XSA-527 / CVE-2026-100081. Fixes: b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect") Reported-by: kerhunt Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross --- drivers/net/xen-netback/interface.c | 2 -- drivers/net/xen-netback/xenbus.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c index a0a438881388..b233834ec6cc 100644 --- a/drivers/net/xen-netback/interface.c +++ b/drivers/net/xen-netback/interface.c @@ -812,8 +812,6 @@ void xenvif_disconnect_data(struct xenvif *vif) xenvif_disconnect_queue(queue); } - - xenvif_mcast_addr_list_free(vif); } void xenvif_disconnect_ctrl(struct xenvif *vif) diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c index c1034d8f6bf0..a826fa24258b 100644 --- a/drivers/net/xen-netback/xenbus.c +++ b/drivers/net/xen-netback/xenbus.c @@ -267,6 +267,8 @@ static void backend_disconnect(struct backend_info *be) vif->num_queues = 0; synchronize_net(); + xenvif_mcast_addr_list_free(vif); + for (queue_index = 0; queue_index < num_queues; ++queue_index) xenvif_deinit_queue(&vif->queues[queue_index]);