linux/drivers/net/xen-netback
Jeongjun Park 0fa5e94a18 net/xen-netback: prevent UAF in xenvif_flush_hash()
During the list_for_each_entry_rcu iteration call of xenvif_flush_hash,
kfree_rcu does not exist inside the rcu read critical section, so if
kfree_rcu is called when the rcu grace period ends during the iteration,
UAF occurs when accessing head->next after the entry becomes free.

Therefore, to solve this, you need to change it to list_for_each_entry_safe.

Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Link: https://patch.msgid.link/20240822181109.2577354-1-aha310510@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2024-08-28 17:07:42 -07:00
..
common.h net: extend ubuf_info callback to ops structure 2024-04-22 16:21:35 -07:00
hash.c net/xen-netback: prevent UAF in xenvif_flush_hash() 2024-08-28 17:07:42 -07:00
interface.c net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
netback.c Merge branch 'for-uring-ubufops' into HEAD 2024-04-22 17:15:39 -07:00
rx.c xen/netback: don't call kfree_skb() with interrupts disabled 2022-12-06 16:00:33 +01:00
xenbus.c driver core: make struct bus_type.uevent() take a const * 2023-01-27 13:45:52 +01:00