On Tue, Mar 1, 2022 at 9:26 AM Yi Wang <[email protected]> wrote: > > From: Zhang Min <[email protected]> > > When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device > and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, > triggering use-after-free. > > Call Trace of unbinding driver free vp_vdpa : > do_syscall_64 > vfs_write > kernfs_fop_write_iter > device_release_driver_internal > pci_device_remove > vp_vdpa_remove > vdpa_unregister_device > kobject_release > device_release > kfree > > Call Trace of dereference vp_vdpa->mdev.pci_dev: > vp_modern_remove > pci_release_selected_regions > pci_release_region > pci_resource_len > pci_resource_end > (dev)->resource[(bar)].end > > Signed-off-by: Zhang Min <[email protected]> > Signed-off-by: Yi Wang <[email protected]>
Acked-by: Jason Wang <[email protected]> > --- > drivers/vdpa/virtio_pci/vp_vdpa.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/vdpa/virtio_pci/vp_vdpa.c > b/drivers/vdpa/virtio_pci/vp_vdpa.c > index a57e381e830b..cce101e6a940 100644 > --- a/drivers/vdpa/virtio_pci/vp_vdpa.c > +++ b/drivers/vdpa/virtio_pci/vp_vdpa.c > @@ -533,8 +533,8 @@ static void vp_vdpa_remove(struct pci_dev *pdev) > { > struct vp_vdpa *vp_vdpa = pci_get_drvdata(pdev); > > - vdpa_unregister_device(&vp_vdpa->vdpa); > vp_modern_remove(&vp_vdpa->mdev); > + vdpa_unregister_device(&vp_vdpa->vdpa); > } > > static struct pci_driver vp_vdpa_driver = { > -- > 2.27.0 > _______________________________________________ Virtualization mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/virtualization
