Re: [Xen-devel] xen-netfront crash when detaching network while some network activity

[Marek Marczykowski-GÃrecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>]

On Tue, May 26, 2015 at 11:56:00AM +0100, David Vrabel wrote:
> On 22/05/15 12:49, Marek Marczykowski-GÃrecki wrote:
> > Hi all,
> > 
> > I'm experiencing xen-netfront crash when doing xl network-detach while
> > some network activity is going on at the same time. It happens only when
> > domU has more than one vcpu. Not sure if this matters, but the backend
> > is in another domU (not dom0). I'm using Xen 4.2.2. It happens on kernel
> > 3.9.4 and 4.1-rc1 as well.
> > 
> > Steps to reproduce:
> > 1. Start the domU with some network interface
> > 2. Call there 'ping -f some-IP'
> > 3. Call 'xl network-detach NAME 0'
> 
> There's a use-after-free in xennet_remove().  Does this patch fix it?

Unfortunately not. Note that the crash is in xennet_disconnect_backend,
which is called before xennet_destroy_queues in xennet_remove.
I've tried to add napi_disable and even netif_napi_del just after
napi_synchronize in xennet_disconnect_backend (which would probably
cause crash when trying to cleanup the same later again), but it doesn't
help - the crash is the same (still in gnttab_end_foreign_access called
from xennet_disconnect_backend).


> 8<--------------------------------
> xen-netfront: properly destroy queues when removing device
> 
> xennet_remove() freed the queues before freeing the netdevice which
> results in a use-after-free when free_netdev() tries to delete the
> napi instances that have already been freed.
> 
> Fix this by fully destroy the queues (which includes deleting the napi
> instances) before freeing the netdevice.
> 
> Reported-by: Marek Marczykowski <marmarek@xxxxxxxxxxxxxxxxxxxxxx>
> Signed-off-by: David Vrabel <david.vrabel@xxxxxxxxxx>
> ---
>  drivers/net/xen-netfront.c |   15 ++-------------
>  1 file changed, 2 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
> index 3f45afd..e031c94 100644
> --- a/drivers/net/xen-netfront.c
> +++ b/drivers/net/xen-netfront.c
> @@ -1698,6 +1698,7 @@ static void xennet_destroy_queues(struct netfront_info 
> *info)
>  
>               if (netif_running(info->netdev))
>                       napi_disable(&queue->napi);
> +             del_timer_sync(&queue->rx_refill_timer);
>               netif_napi_del(&queue->napi);
>       }
>  
> @@ -2102,9 +2103,6 @@ static const struct attribute_group xennet_dev_group = {
>  static int xennet_remove(struct xenbus_device *dev)
>  {
>       struct netfront_info *info = dev_get_drvdata(&dev->dev);
> -     unsigned int num_queues = info->netdev->real_num_tx_queues;
> -     struct netfront_queue *queue = NULL;
> -     unsigned int i = 0;
>  
>       dev_dbg(&dev->dev, "%s\n", dev->nodename);
>  
> @@ -2112,16 +2110,7 @@ static int xennet_remove(struct xenbus_device *dev)
>  
>       unregister_netdev(info->netdev);
>  
> -     for (i = 0; i < num_queues; ++i) {
> -             queue = &info->queues[i];
> -             del_timer_sync(&queue->rx_refill_timer);
> -     }
> -
> -     if (num_queues) {
> -             kfree(info->queues);
> -             info->queues = NULL;
> -     }
> -
> +     xennet_destroy_queues(info);
>       xennet_free_netdev(info->netdev);
>  
>       return 0;

-- 
Best Regards,
Marek Marczykowski-GÃrecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

Attachment: pgpTLy0nMBXcs.pgp
Description: PGP signature

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel