From: Amit Shah <amit.shah@redhat.com>
To: Virtualization List <virtualization@lists.linux-foundation.org>
Cc: Amit Shah <amit.shah@redhat.com>
Subject: [PATCH v3 9/9] virtio: console: prevent use-after-free of port name in port unplug
Date: Thu, 25 Jul 2013 19:28:49 +0530 [thread overview]
Message-ID: <83c058bc32c4e377a75235120885aec7dfd223c7.1374759439.git.amit.shah@redhat.com> (raw)
In-Reply-To: <cover.1374759439.git.amit.shah@redhat.com>
In-Reply-To: <cover.1374759439.git.amit.shah@redhat.com>
Remove the debugfs path before freeing port->name, to prevent a possible
use-after-free.
Reported-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
---
drivers/char/virtio_console.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 4e380c1..e910bec 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1574,9 +1574,8 @@ static void unplug_port(struct port *port)
device_destroy(pdrvdata.class, port->dev->devt);
cdev_del(port->cdev);
- kfree(port->name);
-
debugfs_remove(port->debugfs_file);
+ kfree(port->name);
/*
* Locks around here are not necessary - a port can't be
--
1.8.1.4
next prev parent reply other threads:[~2013-07-25 13:58 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-25 13:58 [PATCH v3 0/9] virtio: console: fixes for bugs and races with unplug Amit Shah
2013-07-25 13:58 ` [PATCH v3 1/9] virtio: console: fix race with port unplug and open/close Amit Shah
2013-07-25 13:58 ` [PATCH v3 2/9] virtio: console: fix race in port_fops_open() and port unplug Amit Shah
2013-07-25 13:58 ` [PATCH v3 3/9] virtio: console: clean up port data immediately at time of unplug Amit Shah
2013-07-25 13:58 ` [PATCH v3 4/9] virtio: console: fix raising SIGIO after port unplug Amit Shah
2013-07-25 13:58 ` [PATCH v3 5/9] virtio: console: return -ENODEV on all read operations after unplug Amit Shah
2013-07-25 13:58 ` [PATCH v3 6/9] virtio: console: add locks around buffer removal in port unplug path Amit Shah
2013-07-29 4:53 ` Rusty Russell
2013-07-25 13:58 ` [PATCH v3 7/9] virtio: console: add locking " Amit Shah
2013-07-29 4:54 ` Rusty Russell
2013-07-25 13:58 ` [PATCH v3 8/9] virtio: console: fix locking around send_sigio_to_port() Amit Shah
2013-07-29 4:55 ` Rusty Russell
2013-07-25 13:58 ` Amit Shah [this message]
2013-07-29 4:56 ` [PATCH v3 9/9] virtio: console: prevent use-after-free of port name in port unplug Rusty Russell
2013-07-31 8:10 ` Amit Shah
2013-08-01 0:59 ` Rusty Russell
2013-08-02 8:39 ` Amit Shah
[not found] ` <7ca111ad3bca069f921b4234e5b3ccbbfd7a11d8.1374759439.git.amit.shah@redhat.com>
2013-07-29 4:48 ` [PATCH v3 1/9] virtio: console: fix race with port unplug and open/close Rusty Russell
[not found] ` <87ob9m6kej.fsf@rustcorp.com.au>
2013-07-30 9:28 ` Amit Shah
[not found] ` <d8ffeceebfc527db85406850d22fa3da64aabbe3.1374759439.git.amit.shah@redhat.com>
2013-07-29 4:50 ` [PATCH v3 3/9] virtio: console: clean up port data immediately at time of unplug Rusty Russell
[not found] ` <a3aca79feb7163e08b940ddefceabf78ab4cd8ce.1374759439.git.amit.shah@redhat.com>
2013-07-29 4:50 ` [PATCH v3 2/9] virtio: console: fix race in port_fops_open() and port unplug Rusty Russell
[not found] ` <e4199103bd85fae76ce7009d7d6abacf28f1f972.1374759439.git.amit.shah@redhat.com>
2013-07-29 4:51 ` [PATCH v3 4/9] virtio: console: fix raising SIGIO after " Rusty Russell
[not found] ` <f218052d8d8438fea0d1c3483434e315c7e82db8.1374759439.git.amit.shah@redhat.com>
2013-07-29 4:53 ` [PATCH v3 5/9] virtio: console: return -ENODEV on all read operations after unplug Rusty Russell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=83c058bc32c4e377a75235120885aec7dfd223c7.1374759439.git.amit.shah@redhat.com \
--to=amit.shah@redhat.com \
--cc=virtualization@lists.linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).