Zheng Wang b5664e929e 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition ... [ Upstream commit ea4f100940 ] In xen_9pfs_front_probe, it calls xen_9pfs_front_alloc_dataring to init priv->rings and bound &ring->work with p9_xen_response. When it calls xen_9pfs_front_event_handler to handle IRQ requests, it will finally call schedule_work to start the work. When we call xen_9pfs_front_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in xen_9pfs_front_free. Note that, this bug is found by static analysis, which might be false positive. CPU0 CPU1 |p9_xen_response xen_9pfs_front_remove| xen_9pfs_front_free| kfree(priv) | //free priv | |p9_tag_lookup |//use priv->client Fixes: 71ebd71921 ("xen/9pfs: connect to the backend") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Signed-off-by: Eric Van Hensbergen <ericvh@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-04-20 12:02:11 +02:00
..
client.c	net/9p: Initialize the iounit field during fid creation	2022-08-25 11:11:30 +02:00
error.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
Kconfig	xen/9pfs: select CONFIG_XEN_XENBUS_FRONTEND	2017-05-02 11:14:36 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mod.c
protocol.c	9p: p9dirent_read: check network-provided name length	2019-07-03 13:15:58 +02:00
protocol.h
trans_common.c	net/9p: include trans_common.h to fix missing prototype warning.	2019-07-03 13:15:59 +02:00
trans_common.h	net/9p: remove (now-)unused helpers	2015-04-11 22:28:29 -04:00
trans_fd.c	net/9p: Fix a potential socket leak in p9_socket_open	2022-12-08 11:16:32 +01:00
trans_rdma.c	9p/rdma: remove useless check in cm_event_handler	2019-07-03 13:15:58 +02:00
trans_virtio.c	9p/trans_virtio: Remove sysfs file on probe failure	2021-09-26 13:37:28 +02:00
trans_xen.c	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition	2023-04-20 12:02:11 +02:00
util.c	net/9p: convert to idr_alloc()	2013-02-27 19:10:20 -08:00