mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 21:33:52 +00:00
vdpa: fix use-after-free on vp_vdpa_remove
[ Upstream commiteb057b44db
] When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free. Call Trace of unbinding driver free vp_vdpa : do_syscall_64 vfs_write kernfs_fop_write_iter device_release_driver_internal pci_device_remove vp_vdpa_remove vdpa_unregister_device kobject_release device_release kfree Call Trace of dereference vp_vdpa->mdev.pci_dev: vp_modern_remove pci_release_selected_regions pci_release_region pci_resource_len pci_resource_end (dev)->resource[(bar)].end Signed-off-by: Zhang Min <zhang.min9@zte.com.cn> Signed-off-by: Yi Wang <wang.yi59@zte.com.cn> Link: https://lore.kernel.org/r/20220301091059.46869-1-wang.yi59@zte.com.cn Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Fixes:64b9f64f80
("vdpa: introduce virtio pci driver") Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
8848b0fa9b
commit
4b1743bc71
1 changed files with 1 additions and 1 deletions
|
@ -513,8 +513,8 @@ static void vp_vdpa_remove(struct pci_dev *pdev)
|
|||
{
|
||||
struct vp_vdpa *vp_vdpa = pci_get_drvdata(pdev);
|
||||
|
||||
vdpa_unregister_device(&vp_vdpa->vdpa);
|
||||
vp_modern_remove(&vp_vdpa->mdev);
|
||||
vdpa_unregister_device(&vp_vdpa->vdpa);
|
||||
}
|
||||
|
||||
static struct pci_driver vp_vdpa_driver = {
|
||||
|
|
Loading…
Reference in a new issue