Commit d0fe8c88 authored Sep 19, 2013 by Nikolay Aleksandrov Committed by David S. Miller Sep 19, 2013

netpoll: fix NULL pointer dereference in netpoll_cleanup



I've been hitting a NULL ptr deref while using netconsole because the
np->dev check and the pointer manipulation in netpoll_cleanup are done
without rtnl and the following sequence happens when having a netconsole
over a vlan and we remove the vlan while disabling the netconsole:
	CPU 1					CPU2
					removes vlan and calls the notifier
enters store_enabled(), calls
netdev_cleanup which checks np->dev
and then waits for rtnl
					executes the netconsole netdev
					release notifier making np->dev
					== NULL and releases rtnl
continues to dereference a member of
np->dev which at this point is == NULL

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c194992c

net/core/netpoll.c

+4 −5

Original line number	Diff line number	Diff line
		@@ -1284,15 +1284,14 @@ EXPORT_SYMBOL_GPL(__netpoll_free_async);

		void netpoll_cleanup(struct netpoll *np)
		{
		if (!np->dev)
		return;

		rtnl_lock();
		if (!np->dev)
		goto out;
		__netpoll_cleanup(np);
		rtnl_unlock();

		dev_put(np->dev);
		np->dev = NULL;
		out:
		rtnl_unlock();
		}
		EXPORT_SYMBOL(netpoll_cleanup);

Admin message