From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx1.redhat.com ([209.132.183.28]:49113 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751941AbcANOzr (ORCPT ); Thu, 14 Jan 2016 09:55:47 -0500 Subject: Re: [PATCH] virtio_pci: fix use after free on release To: "Michael S. Tsirkin" , linux-kernel@vger.kernel.org References: <1452780236-27981-1-git-send-email-mst@redhat.com> Cc: stable@vger.kernel.org, Sasha Levin , virtualization@lists.linux-foundation.org From: Jerome Marchand Message-ID: <5697B6EB.8040903@redhat.com> Date: Thu, 14 Jan 2016 15:55:39 +0100 MIME-Version: 1.0 In-Reply-To: <1452780236-27981-1-git-send-email-mst@redhat.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ESLEVhqAwAWkR2bMksF3JJfTvKChn7RlV" Sender: stable-owner@vger.kernel.org List-ID: This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ESLEVhqAwAWkR2bMksF3JJfTvKChn7RlV Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 01/14/2016 03:04 PM, Michael S. Tsirkin wrote: > KASan detected a use-after-free error in virtio-pci remove code. In > virtio_pci_remove(), vp_dev is still used after being freed in > unregister_virtio_device() (in virtio_pci_release_dev() more > precisely). >=20 > To fix, keep a reference until cleanup is done. That does make KASan happy. >=20 > Fixes: 63bd62a08ca4 ("virtio_pci: defer kfree until release callback") > Reported-by: Jerome Marchand > Cc: stable@vger.kernel.org > Cc: Sasha Levin > Signed-off-by: Michael S. Tsirkin Tested-by: Jerome Marchand Thanks, Jerome > --- > drivers/virtio/virtio_pci_common.c | 2 ++ > 1 file changed, 2 insertions(+) >=20 > diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio= _pci_common.c > index 36205c2..f6bed86 100644 > --- a/drivers/virtio/virtio_pci_common.c > +++ b/drivers/virtio/virtio_pci_common.c > @@ -545,6 +545,7 @@ err_enable_device: > static void virtio_pci_remove(struct pci_dev *pci_dev) > { > struct virtio_pci_device *vp_dev =3D pci_get_drvdata(pci_dev); > + struct device *dev =3D get_device(&vp_dev->vdev.dev); > =20 > unregister_virtio_device(&vp_dev->vdev); > =20 > @@ -554,6 +555,7 @@ static void virtio_pci_remove(struct pci_dev *pci_d= ev) > virtio_pci_modern_remove(vp_dev); > =20 > pci_disable_device(pci_dev); > + put_device(dev); > } > =20 > static struct pci_driver virtio_pci_driver =3D { >=20 --ESLEVhqAwAWkR2bMksF3JJfTvKChn7RlV Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJWl7brAAoJEHTzHJCtsuoCl7QIAIRNzfwlJwKUx7P4XibmENCU GizvEcwbVfgyc2Eb1EnOhFpWrPOvpglHuphPFEq1sg9rXbrj8CBO6ICPtDll9MBm RhP1bLAMwe7yFuwaZm1pBsM8NXB66BCioJgbnYrFjwe2Fb+EDu7d9A+Vgk2dwbKd KfjjiUa5OQirLIkTuexZPwPvZS8uLhcTGW7OcrENBOpYdS2S9jA05EAr/cNa8+Qd hGezhcy397xYuZBAEVZbH8MpWRt6SiKDE8Is0HSqQ1mDR1ROaCAjMc8GVQe0jK2o sTu/ldIC3q1l4eaZQstQdF9deg8KN8yk8y7pykPGvOtXgA6N+QibjysGOryEXts= =5K4x -----END PGP SIGNATURE----- --ESLEVhqAwAWkR2bMksF3JJfTvKChn7RlV--