diff options
| author | Edward Cree <ecree@solarflare.com> | 2015-05-20 11:10:03 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-05-21 18:43:53 -0400 |
| commit | 0d322413d6cff0bd2ccafc03ab9314dc55417e9d (patch) | |
| tree | d988fe63fd837ce5127c25f6a517aae0e33d9494 /drivers/net/ethernet/sfc/net_driver.h | |
| parent | f1122a345b96713eb6e059121c592b3c0612f5be (diff) | |
| download | linux-0d322413d6cff0bd2ccafc03ab9314dc55417e9d.tar.bz2 | |
sfc: protect filter table against use-after-free
If MCDI timeouts are encountered during efx_ef10_filter_table_remove(),
an FLR will be queued, but efx->filter_state will still be kfree()d.
The queued FLR will then call efx_ef10_filter_table_restore(), which
will try to use efx->filter_state. This previously caused a panic.
This patch adds an rwsem to protect the existence of efx->filter_state,
separately from the spinlock protecting its contents. Users which can
race against efx_ef10_filter_table_remove() should down_read this rwsem.
Signed-off-by: Shradha Shah <sshah@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/sfc/net_driver.h')
| -rw-r--r-- | drivers/net/ethernet/sfc/net_driver.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h index 55a5f4863e60..f6c4832770ba 100644 --- a/drivers/net/ethernet/sfc/net_driver.h +++ b/drivers/net/ethernet/sfc/net_driver.h @@ -25,6 +25,7 @@ #include <linux/highmem.h> #include <linux/workqueue.h> #include <linux/mutex.h> +#include <linux/rwsem.h> #include <linux/vmalloc.h> #include <linux/i2c.h> #include <linux/mtd/mtd.h> @@ -896,7 +897,8 @@ struct vfdi_status; * @loopback_mode: Loopback status * @loopback_modes: Supported loopback mode bitmask * @loopback_selftest: Offline self-test private state - * @filter_lock: Filter table lock + * @filter_sem: Filter table rw_semaphore, for freeing the table + * @filter_lock: Filter table lock, for mere content changes * @filter_state: Architecture-dependent filter table state * @rps_flow_id: Flow IDs of filters allocated for accelerated RFS, * indexed by filter ID @@ -1038,6 +1040,7 @@ struct efx_nic { void *loopback_selftest; + struct rw_semaphore filter_sem; spinlock_t filter_lock; void *filter_state; #ifdef CONFIG_RFS_ACCEL |