diff options
| author | Haiyang Zhang <haiyangz@microsoft.com> | 2016-03-23 16:43:09 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-03-23 18:38:55 (GMT) |
| commit | d212b4633c3a99561939f2d423eacf3263850bcd (patch) | |
| tree | d5bc5a90517956c625b52bfbf92fb16bc7b9fc3f | |
| parent | 1f461dcdd296eecedaffffc6bae2bfa90bd7eb89 (diff) | |
| download | linux-d212b4633c3a99561939f2d423eacf3263850bcd.tar.xz | |
hv_netvsc: Fix accessing freed memory in netvsc_change_mtu()
struct netvsc_device is freed in rndis_filter_device_remove(). So we save
the nvdev->num_chn into a temp variable for later usage.
(Please also include this patch into stable branch.)
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/hyperv/netvsc_drv.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c index 0860849..b8121eb 100644 --- a/drivers/net/hyperv/netvsc_drv.c +++ b/drivers/net/hyperv/netvsc_drv.c @@ -858,6 +858,7 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) struct netvsc_device *nvdev = hv_get_drvdata(hdev); struct netvsc_device_info device_info; int limit = ETH_DATA_LEN; + u32 num_chn; int ret = 0; if (nvdev == NULL || nvdev->destroy) @@ -873,6 +874,8 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) if (ret) goto out; + num_chn = nvdev->num_chn; + nvdev->start_remove = true; rndis_filter_device_remove(hdev); @@ -883,7 +886,7 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) memset(&device_info, 0, sizeof(device_info)); device_info.ring_size = ring_size; - device_info.num_chn = nvdev->num_chn; + device_info.num_chn = num_chn; device_info.max_num_vrss_chns = max_num_vrss_chns; rndis_filter_device_add(hdev, &device_info); |