• Edward Cree's avatar
    sfc: protect filter table against use-after-free · 0d322413
    Edward Cree authored
    If MCDI timeouts are encountered during efx_ef10_filter_table_remove(),
    an FLR will be queued, but efx->filter_state will still be kfree()d.
    The queued FLR will then call efx_ef10_filter_table_restore(), which
    will try to use efx->filter_state. This previously caused a panic.
    This patch adds an rwsem to protect the existence of efx->filter_state,
    separately from the spinlock protecting its contents.  Users which can
    race against efx_ef10_filter_table_remove() should down_read this rwsem.
    Signed-off-by: default avatarShradha Shah <sshah@solarflare.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    0d322413
net_driver.h 54.3 KB