Re: [Xen-devel] [PATCH] xen/netback: Fix null-pointer access in netback_uevent

["Jan Beulich" <JBeulich@xxxxxxxxxx>]

>>> On 29.05.10 at 20:44, Bastian Blank <waldi@xxxxxxxxxx> wrote:
> The uevent method of Xen netback does not check if the the network
> device is already setup and tries to dereference a null-pointer it not.
> 
> Signed-off-by: Bastian Blank <waldi@xxxxxxxxxx>
> ---
>  drivers/xen/netback/xenbus.c |    3 +--
>  1 files changed, 1 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/xen/netback/xenbus.c b/drivers/xen/netback/xenbus.c
> index 70636d0..88262bb 100644
> --- a/drivers/xen/netback/xenbus.c
> +++ b/drivers/xen/netback/xenbus.c
> @@ -163,7 +163,6 @@ fail:
>  static int netback_uevent(struct xenbus_device *xdev, struct 
> kobj_uevent_env *env)
>  {
>       struct backend_info *be = dev_get_drvdata(&xdev->dev);
> -     struct xen_netif *netif = be->netif;
>       char *val;
>  
>       DPRINTK("netback_uevent");
> @@ -182,7 +181,7 @@ static int netback_uevent(struct xenbus_device *xdev, 
> struct kobj_uevent_env *en
>               kfree(val);
>       }
>  
> -     if (add_uevent_var(env, "vif=%s", netif->dev->name))
> +     if (be && be->netif && add_uevent_var(env, "vif=%s", 
> be->netif->dev->name))
>               return -ENOMEM;
>  
>       return 0;

Unfortunately this still seems incomplete: Just checking be->netif to
be non-NULL isn't sufficient, as the sysfs access may race backend
teardown afaics. Hence proper serialization is going to be needed for
that case.

Furthermore, the backend creation patch also needs adjustment,
as it currently stores a non-NULL non-pointer value in be->netif if
netif_alloc() fails. To require the sysfs path to use IS_ERR() on
be->netif, I think netif_alloc()'s result should be stored to a local 
variable first and only written to be->netif when valid.

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel