• Stefano Garzarella's avatar
    vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock · 0deab087
    Stefano Garzarella authored
    Some callbacks used by the upper layers can run while we are in the
    .remove(). A potential use-after-free can happen, because we free
    the_virtio_vsock without knowing if the callbacks are over or not.
    
    To solve this issue we move the assignment of the_virtio_vsock at the
    end of .probe(), when we finished all the initialization, and at the
    beginning of .remove(), before to release resources.
    For the same reason, we do the same also for the vdev->priv.
    
    We use RCU to be sure that all callbacks that use the_virtio_vsock
    ended before freeing it. This is not required for callbacks that
    use vdev->priv, because after the vdev->config->del_vqs() we are sure
    that they are ended and will no longer be invoked.
    
    We also take the mutex during the .remove() to avoid that .probe() can
    run while we are resetting the device.
    Signed-off-by: default avatarStefano Garzarella <sgarzare@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    0deab087
virtio_transport.c 18.6 KB