virtio_net: fix use after free on allocation failure

In the extremely unlikely event that driver initialization fails after
RX buffers are added, virtio net frees RX buffers while VQs are
still active, potentially causing device to use a freed buffer.

To fix, reset device first - same as we do on device removal.

Signed-off-by: Michael S. Tsirkin <[email protected]>
Reviewed-by: Cornelia Huck <[email protected]>
Signed-off-by: Rusty Russell <[email protected]>

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index aba7b93286b3f243e925be66e3abdef0d970a3da..53031e58a5fc13c6c43b0e4355620c35c110c56c 100644 (file)
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1830,6 +1830,8 @@ static int virtnet_probe(struct virtio_device *vdev)
        return 0;
 
 free_recv_bufs:
+       vi->vdev->config->reset(vdev);
+
        free_receive_bufs(vi);
        unregister_netdev(dev);
 free_vqs: