提交 c383bdd1 编写于 作者: J Jakub Kicinski 提交者: David S. Miller

nfp: fix potential use after free on xdp prog

We should unregister the net_device first, before we give back
our reference on xdp_prog.  Otherwise xdp_prog may be freed
before .ndo_stop() disabled the datapath.  Found by code inspection.

Fixes: ecd63a02 ("nfp: add XDP support in the driver")
Signed-off-by: NJakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: NSimon Horman <simon.horman@netronome.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 2d2517ee
...@@ -3275,9 +3275,10 @@ void nfp_net_netdev_clean(struct net_device *netdev) ...@@ -3275,9 +3275,10 @@ void nfp_net_netdev_clean(struct net_device *netdev)
{ {
struct nfp_net *nn = netdev_priv(netdev); struct nfp_net *nn = netdev_priv(netdev);
unregister_netdev(nn->netdev);
if (nn->xdp_prog) if (nn->xdp_prog)
bpf_prog_put(nn->xdp_prog); bpf_prog_put(nn->xdp_prog);
if (nn->bpf_offload_xdp) if (nn->bpf_offload_xdp)
nfp_net_xdp_offload(nn, NULL); nfp_net_xdp_offload(nn, NULL);
unregister_netdev(nn->netdev);
} }
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册