FEX-Emu/linux
1
0
Fork 0
mirror of https://github.com/FEX-Emu/linux.git synced 2025-01-13 04:41:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

netconsole: fix NULL pointer dereference

Browse Source 
We need to disable the netconsole (enabled = 0) before setting nt->np.dev
to NULL because otherwise we might still have users after the
netpoll_cleanup() since nt->enabled is set afterwards and we can
have a message which will result in a NULL pointer dereference.
It is very easy to hit dereferences all over the netpoll_send_udp function
by running the following two loops in parallel:
while [ 1 ]; do echo 1 > enabled; echo 0 > enabled; done;
while [ 1 ]; do echo 00:11:22:33:44:55 > remote_mac; done;
(the second loop is to generate messages, it can be done by anything)

We're safe to set nt->np.dev = NULL and nt->enabled = 0 with the spinlock
since it's required in the write_msg() function.

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Reviewed-by: Veacelsav Falico <vfalico@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Nikolay Aleksandrov 2013-10-23 15:04:49 +02:00 committed by David S. Miller
parent 0e67d9903d
commit 45e526e80e
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/net/netconsole.c
View File

@ -310,6 +310,7 @@ static ssize_t store_enabled(struct netconsole_target *nt,
const char *buf, const char *buf,
size_t count) size_t count)
{ {
unsigned long flags;
int enabled; int enabled;
int err; int err;
@ -342,6 +343,13 @@ static ssize_t store_enabled(struct netconsole_target *nt,
printk(KERN_INFO "netconsole: network logging started\n"); printk(KERN_INFO "netconsole: network logging started\n");
} else { /* 0 */ } else { /* 0 */
/* We need to disable the netconsole before cleaning it up
* otherwise we might end up in write_msg() with
* nt->np.dev == NULL and nt->enabled == 1
*/
spin_lock_irqsave(&target_list_lock, flags);
nt->enabled = 0;
spin_unlock_irqrestore(&target_list_lock, flags);
netpoll_cleanup(&nt->np); netpoll_cleanup(&nt->np);
} }