netvsc: handle select_queue when device is being removed
Move the send indirection table from the inner device (netvsc)
to the network device context.
It is possible that netvsc_device is not present (remove in progress).
This solves potential use after free issues when packet is being
created during MTU change, shutdown, or queue count changes.
Fixes: d8e18ee0fa
("netvsc: enhance transmit select_queue")
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:

committed by
David S. Miller

szülő
ecd052250b
commit
7ce1012466
@@ -1136,15 +1136,11 @@ static void netvsc_receive(struct net_device *ndev,
|
||||
static void netvsc_send_table(struct hv_device *hdev,
|
||||
struct nvsp_message *nvmsg)
|
||||
{
|
||||
struct netvsc_device *nvscdev;
|
||||
struct net_device *ndev = hv_get_drvdata(hdev);
|
||||
struct net_device_context *net_device_ctx = netdev_priv(ndev);
|
||||
int i;
|
||||
u32 count, *tab;
|
||||
|
||||
nvscdev = get_outbound_net_device(hdev);
|
||||
if (!nvscdev)
|
||||
return;
|
||||
|
||||
count = nvmsg->msg.v5_msg.send_table.count;
|
||||
if (count != VRSS_SEND_TAB_SIZE) {
|
||||
netdev_err(ndev, "Received wrong send-table size:%u\n", count);
|
||||
@@ -1155,7 +1151,7 @@ static void netvsc_send_table(struct hv_device *hdev,
|
||||
nvmsg->msg.v5_msg.send_table.offset);
|
||||
|
||||
for (i = 0; i < count; i++)
|
||||
nvscdev->send_table[i] = tab[i];
|
||||
net_device_ctx->tx_send_table[i] = tab[i];
|
||||
}
|
||||
|
||||
static void netvsc_send_vf(struct net_device_context *net_device_ctx,
|
||||
|
Reference in New Issue
Block a user