Commit ae9e63bb authored by Haiyang Zhang's avatar Haiyang Zhang Committed by David S. Miller

hyperv: Move wait completion msg code into rndis_filter_halt_device()

We need to wait for send_completion msg before put_rndis_request() at
the end of rndis_filter_halt_device(). Otherwise, netvsc_send_completion()
may reference freed memory which is overwritten, and cause panic.
Reported-by: default avatarLong Li <longli@microsoft.com>
Reported-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2207b60f
...@@ -383,13 +383,6 @@ int netvsc_device_remove(struct hv_device *device) ...@@ -383,13 +383,6 @@ int netvsc_device_remove(struct hv_device *device)
unsigned long flags; unsigned long flags;
net_device = hv_get_drvdata(device); net_device = hv_get_drvdata(device);
spin_lock_irqsave(&device->channel->inbound_lock, flags);
net_device->destroy = true;
spin_unlock_irqrestore(&device->channel->inbound_lock, flags);
/* Wait for all send completions */
wait_event(net_device->wait_drain,
atomic_read(&net_device->num_outstanding_sends) == 0);
netvsc_disconnect_vsp(net_device); netvsc_disconnect_vsp(net_device);
......
...@@ -718,6 +718,9 @@ static void rndis_filter_halt_device(struct rndis_device *dev) ...@@ -718,6 +718,9 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
{ {
struct rndis_request *request; struct rndis_request *request;
struct rndis_halt_request *halt; struct rndis_halt_request *halt;
struct netvsc_device *nvdev = dev->net_dev;
struct hv_device *hdev = nvdev->dev;
ulong flags;
/* Attempt to do a rndis device halt */ /* Attempt to do a rndis device halt */
request = get_rndis_request(dev, RNDIS_MSG_HALT, request = get_rndis_request(dev, RNDIS_MSG_HALT,
...@@ -735,6 +738,14 @@ static void rndis_filter_halt_device(struct rndis_device *dev) ...@@ -735,6 +738,14 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
dev->state = RNDIS_DEV_UNINITIALIZED; dev->state = RNDIS_DEV_UNINITIALIZED;
cleanup: cleanup:
spin_lock_irqsave(&hdev->channel->inbound_lock, flags);
nvdev->destroy = true;
spin_unlock_irqrestore(&hdev->channel->inbound_lock, flags);
/* Wait for all send completions */
wait_event(nvdev->wait_drain,
atomic_read(&nvdev->num_outstanding_sends) == 0);
if (request) if (request)
put_rndis_request(dev, request); put_rndis_request(dev, request);
return; return;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment