[PATCH net] nfp: fix potential use after free on xdp prog

[PATCH net] nfp: fix potential use after free on xdp prog

[Jakub Kicinski]

We should unregister the net_device first, before we give back
our reference on xdp_prog.  Otherwise xdp_prog may be freed
before .ndo_stop() disabled the datapath.  Found by code inspection.

Fixes: ecd63a0217d5 ("nfp: add XDP support in the driver")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
---
Just a heads up - this will cause a merge conflict since nn->netdev
member got moved to nn->dp.netdev in net-next.

 drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 9179a99563af..a41377e26c07 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -3275,9 +3275,10 @@ void nfp_net_netdev_clean(struct net_device *netdev)
 {
 	struct nfp_net *nn = netdev_priv(netdev);
 
+	unregister_netdev(nn->netdev);
+
 	if (nn->xdp_prog)
 		bpf_prog_put(nn->xdp_prog);
 	if (nn->bpf_offload_xdp)
 		nfp_net_xdp_offload(nn, NULL);
-	unregister_netdev(nn->netdev);
 }
-- 
2.11.0

Re: [PATCH net] nfp: fix potential use after free on xdp prog

[David Miller]

From: Jakub Kicinski <jakub.kicinski@netronome.com>
Date: Tue,  4 Apr 2017 15:56:55 -0700

> We should unregister the net_device first, before we give back
> our reference on xdp_prog.  Otherwise xdp_prog may be freed
> before .ndo_stop() disabled the datapath.  Found by code inspection.
> 
> Fixes: ecd63a0217d5 ("nfp: add XDP support in the driver")
> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
> Reviewed-by: Simon Horman <simon.horman@netronome.com>

Applied, thanks.

> ---
> Just a heads up - this will cause a merge conflict since nn->netdev
> member got moved to nn->dp.netdev in net-next.

Ok, thanks for the heads up.