diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2021-06-08 10:29:39 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2021-06-08 10:29:39 -0700 |
| commit | 368094df48e680fa51cedb68537408cfa64b788e (patch) | |
| tree | b8ee763cd0f2e2a34e2d035d4c637ba472cccfaf /drivers | |
| parent | 374aeb91db48bb52216bb9308d611c816fb6cacb (diff) | |
| parent | 107866a8eb0b664675a260f1ba0655010fac1e08 (diff) | |
Merge tag 'for-linus-5.13b-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fix from Juergen Gross:
"A single patch fixing a Xen related security bug: a malicious guest
might be able to trigger a 'use after free' issue in the xen-netback
driver"
* tag 'for-linus-5.13b-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xen-netback: take a reference to the RX task thread
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/xen-netback/interface.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c index 193b723fe3bd..c58996c1e230 100644 --- a/drivers/net/xen-netback/interface.c +++ b/drivers/net/xen-netback/interface.c @@ -684,6 +684,7 @@ static void xenvif_disconnect_queue(struct xenvif_queue *queue) { if (queue->task) { kthread_stop(queue->task); + put_task_struct(queue->task); queue->task = NULL; } @@ -745,6 +746,11 @@ int xenvif_connect_data(struct xenvif_queue *queue, if (IS_ERR(task)) goto kthread_err; queue->task = task; + /* + * Take a reference to the task in order to prevent it from being freed + * if the thread function returns before kthread_stop is called. + */ + get_task_struct(task); task = kthread_run(xenvif_dealloc_kthread, queue, "%s-dealloc", queue->name); |