-
由 Roger Pau Monne 提交于
stable inclusion from stable-5.10.43 commit 6b53db8c4c14b4e7256f058d202908b54a7b85b4 bugzilla: 109284 CVE: NA -------------------------------- commit 107866a8 upstream. Do this in order to prevent the task from being freed if the thread returns (which can be triggered by the frontend) before the call to kthread_stop done as part of the backend tear down. Not taking the reference will lead to a use-after-free in that scenario. Such reference was taken before but dropped as part of the rework done in 2ac061ce. Reintroduce the reference taking and add a comment this time explaining why it's needed. This is XSA-374 / CVE-2021-28691. Fixes: 2ac061ce ('xen/netback: cleanup init and deinit code') Signed-off-by: NRoger Pau Monné <roger.pau@citrix.com> Cc: stable@vger.kernel.org Reviewed-by: NJan Beulich <jbeulich@suse.com> Reviewed-by: NJuergen Gross <jgross@suse.com> Signed-off-by: NJuergen Gross <jgross@suse.com> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: NChen Jun <chenjun102@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
424eedfc