On Wed, 24 Feb 2021 18:21:09 +0100 Greg KH gregkh@linuxfoundation.org wrote:
On Wed, Feb 24, 2021 at 06:03:56PM +0100, SeongJae Park wrote:
This is a request for merge of upstream commit 4a658527271b ("xen-netback: delete NAPI instance when queue fails to initialize") on v4.4.y tree.
If 'xenvif_connect()' fails after successful 'netif_napi_add()', the napi is not cleaned up. Because 'create_queues()' frees the queues in its error handling code, if the 'xenvif_free()' is called for the vif, use-after-free occurs. The upstream commit fixes the problem by cleaning up the napi in the 'xenvif_connect()'.
Attaching the original patch below for your convenience.
The original patch does not apply cleanly.
I tested the commit is cleanly applicable with 'git cherry-pick' before posting this. I just tried 'git format-patch ... && git am ...' and confirmed it doesn't work. Sorry, my fault.
Tested-by: Markus Boehme markubo@amazon.de
What was tested?
We confirmed the unmodified v4.4.y kernel crashes on a stress test that repeatedly doing netdev attach/detach, while the patch applied version doesn't.
I backported the patch, but next time, please provide the patch that will work properly.
Thanks, and apology for the inconvenience. I will do the check with posting patch again rather than only 'git cherry-pick' from next time.
Thanks, SeongJae Park
greg k-h