Stefano Garzarella
1fa81b7cad
vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock ...
[ Upstream commit 9c7a5582f5d720dc35cfcc42ccaded69f0642e4a ]
Some callbacks used by the upper layers can run while we are in the
.remove(). A potential use-after-free can happen, because we free
the_virtio_vsock without knowing if the callbacks are over or not.
To solve this issue we move the assignment of the_virtio_vsock at the
end of .probe(), when we finished all the initialization, and at the
beginning of .remove(), before to release resources.
For the same reason, we do the same also for the vdev->priv.
We use RCU to be sure that all callbacks that use the_virtio_vsock
ended before freeing it. This is not required for callbacks that
use vdev->priv, because after the vdev->config->del_vqs() we are sure
that they are ended and will no longer be invoked.
We also take the mutex during the .remove() to avoid that .probe() can
run while we are resetting the device.
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-07 08:00:05 +02:00
6lowpan: Off by one handling ->nexthdr
2020-01-27 14:50:41 +01:00
net/9p: validate fds in p9_fd_open
2020-08-11 15:32:32 +02:00
vlan: vlan_changelink() should propagate errors
2020-01-12 12:17:28 +01:00
appletalk: Set error code if register_snap_client failed
2019-12-13 08:52:59 +01:00
atm: fix a memory leak of vcc->user_back
2020-10-01 13:14:43 +02:00
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 18:37:48 +02:00
batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
2020-10-01 13:14:52 +02:00
Bluetooth: Handle Inquiry Cancel error after Inquiry Complete
2020-10-01 13:14:44 +02:00
bpf/test_run: support cgroup local storage
2018-08-03 00:47:32 +02:00
signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig
2020-01-27 14:50:51 +01:00
net: bridge: enfore alignment for ethernet address
2020-06-30 23:17:03 -04:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-11-10 11:27:48 +01:00
can: gw: Fix error path of cgw_module_init
2019-08-29 08:28:30 +02:00
libceph: don't omit recovery_deletes in target_copy()
2020-07-22 09:32:13 +02:00
bpf: Fix clobbering of r2 in bpf_gen_ld_abs
2020-10-01 13:14:52 +02:00
net: DCB: Validate DCB_ATTR_DCB_BUFFER argument
2020-09-26 18:01:29 +02:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-04-29 16:31:16 +02:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:13:37 +01:00
KEYS: Don't write out to userspace while holding key semaphore
2020-04-23 10:30:24 +02:00
dsa: Allow forwarding of redirected IGMP traffic
2020-09-23 12:10:56 +02:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:19:09 +01:00
hsr: check protocol version in hsr_newlink()
2020-04-21 09:03:03 +02:00
nl802154: add missing attribute validation for dev_type
2020-03-18 07:14:15 +01:00
rt_cpu_seq_next should increase position index
2020-10-01 13:14:29 +02:00
ipv6_route_seq_next should increase position index
2020-10-01 13:14:29 +02:00
net/af_iucv: always register net_device notifier
2020-01-27 14:50:56 +01:00
kcm: switch order of device registration to fix a crash
2019-04-17 08:38:40 +02:00
af_key: pfkey_dump needs parameter validation
2020-09-26 18:01:28 +02:00
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-22 09:31:59 +02:00
lapb: fixed leak of control-blocks.
2019-06-22 08:15:13 +02:00
net: silence data-races on sk_backlog.tail
2020-10-01 13:14:26 +02:00
mac80211: fix misplaced while instead of if
2020-08-21 11:05:32 +02:00
mac802154: tx: fix use-after-free
2020-10-01 13:14:51 +02:00
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2020-04-29 16:31:17 +02:00
net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler
2018-08-22 21:39:08 -07:00
netfilter: conntrack: allow sctp hearbeat after connection re-use
2020-09-17 13:45:24 +02:00
netlabel: fix problems with mapping removal
2020-09-12 13:40:22 +02:00
genetlink: remove genl_bind
2020-07-22 09:31:58 +02:00
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-04-29 16:31:21 +02:00
net/nfc/rawsock.c: add CAP_NET_RAW check.
2020-08-19 08:15:03 +02:00
nsh: set mac len based on inner packet
2018-07-12 16:55:29 -07:00
net: openvswitch: use div_u64() for 64-by-32 divisions
2020-10-01 13:14:49 +02:00
af_packet: TPACKET_V3: fix fill status rwlock imbalance
2020-08-19 08:15:03 +02:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-11-10 11:27:48 +01:00
net: psample: fix skb_over_panic
2019-12-05 09:21:30 +01:00
net: qrtr: check skb_put_padto() return value
2020-09-26 18:01:30 +02:00
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-05 10:06:01 +02:00
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 12:17:17 +01:00
net/rose: fix unbound loop in rose_loopback_timer()
2019-05-02 09:59:00 +02:00
rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
2020-08-11 15:32:35 +02:00
net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc
2020-09-26 18:01:30 +02:00
sctp: move trace_sctp_probe_path into sctp_outq_sack
2020-10-01 13:14:30 +02:00
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
2020-09-03 11:24:17 +02:00
net: strparser: partially revert "strparser: Call skb_unclone conditionally"
2019-05-16 19:41:27 +02:00
svcrdma: Fix leak of transport addresses
2020-10-01 13:14:40 +02:00
tipc: fix memory leak in service subscripting
2020-10-01 13:14:44 +02:00
net/tls: Fix kmap usage
2020-08-19 08:15:03 +02:00
skbuff: fix a data race in skb_queue_len()
2020-10-01 13:14:32 +02:00
vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock
2020-10-07 08:00:05 +02:00
wimax: remove blank lines at EOF
2018-07-24 14:10:42 -07:00
cfg80211: regulatory: reject invalid hints
2020-09-09 19:04:32 +02:00
net/x25: Fix null-ptr-deref in x25_disconnect
2020-08-05 10:06:02 +02:00
xdp: Fix xsk_generic_xmit errno
2020-06-25 15:33:05 +02:00
xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
2020-06-30 23:17:10 -04:00
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 11:05:32 +02:00
net: remove blank lines at end of file
2018-07-24 14:10:43 -07:00
bpfilter: check compiler capability in Kconfig
2018-06-28 13:36:39 +09:00
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-19 08:15:03 +02:00
1fa81b7cad