From: Tu Dinh Date: Sat, 7 Nov 2026 12:35:51 +0100 Subject: [PATCH] xen-netback: Zero out sring pointers on unmap If xenvif_map_frontend_data_rings() fails when a ring is already mapped, it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the ring pointers unchanged. xenvif_connect_data()'s cleanup path calls xenvif_disconnect_queue() which in turn calls xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the pointers a second time. Zero out the ring pointers after they are unmapped to avoid this issue. This is XSA-532 Fixes: 2ac061ce97f4 ("xen/netback: cleanup init and deinit code") Signed-off-by: Tu Dinh Reviewed-by: Juergen Gross --- drivers/net/xen-netback/netback.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index 3cdb7fd659db..dc229756bdc2 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -1530,12 +1530,17 @@ static inline bool tx_dealloc_work_todo(struct xenvif_queue *queue) void xenvif_unmap_frontend_data_rings(struct xenvif_queue *queue) { - if (queue->tx.sring) + if (queue->tx.sring) { xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif), queue->tx.sring); - if (queue->rx.sring) + queue->tx.sring = NULL; + } + + if (queue->rx.sring) { xenbus_unmap_ring_vfree(xenvif_to_xenbus_device(queue->vif), queue->rx.sring); + queue->rx.sring = NULL; + } } int xenvif_map_frontend_data_rings(struct xenvif_queue *queue, -- 2.56.0