[PATCH] vfio: fix possible use after free of vfio group

[PATCH] vfio: fix possible use after free of vfio group

[Ilya Lesokhin]

The vfio group should be released after
the vfio_group_try_dissolve_container call.
The code should not rely on someone else to hold
a reference on the group.

Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com>
---
 drivers/vfio/vfio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 6fd6fa5..d1d70e0 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -1711,8 +1711,8 @@ EXPORT_SYMBOL_GPL(vfio_group_get_external_user);
 
 void vfio_group_put_external_user(struct vfio_group *group)
 {
-	vfio_group_put(group);
 	vfio_group_try_dissolve_container(group);
+	vfio_group_put(group);
 }
 EXPORT_SYMBOL_GPL(vfio_group_put_external_user);
 
-- 
1.8.3.1

Re: [PATCH] vfio: fix possible use after free of vfio group

[Alex Williamson]

On Thu, 14 Jul 2016 16:50:19 +0300
Ilya Lesokhin <ilyal@mellanox.com> wrote:

> The vfio group should be released after
> the vfio_group_try_dissolve_container call.
> The code should not rely on someone else to hold
> a reference on the group.
> 
> Signed-off-by: Ilya Lesokhin <ilyal@mellanox.com>
> ---
>  drivers/vfio/vfio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index 6fd6fa5..d1d70e0 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -1711,8 +1711,8 @@ EXPORT_SYMBOL_GPL(vfio_group_get_external_user);
>  
>  void vfio_group_put_external_user(struct vfio_group *group)
>  {
> -	vfio_group_put(group);
>  	vfio_group_try_dissolve_container(group);
> +	vfio_group_put(group);
>  }
>  EXPORT_SYMBOL_GPL(vfio_group_put_external_user);
>  

Yep, I think you're right.  @group can clearly be freed via
vfio_group_put() and this ordering matches vfio_group_fops_release().
I suspect this ordering was based on reversing how
vfio_group_get_external_user() works, but with that function the caller
has a file reference to the group so we can delay acquiring another
group reference until we've worked through all the container usage exit
cases.  I'll do some testing and apply to my next branch for v4.8 if
all goes well.  Thanks!

Alex