linux-kernel - [PATCHv2] virtio: Don't access device data after unregistration.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri,  7 Sep 2012 08:57:45 +0200
From:	sjur.brandeland@...ricsson.com
To:	"Michael S . Tsirkin" <mst@...hat.com>
Cc:	Sjur Brændeland <sjurbren@...il.com>,
	Sjur Brændeland <sjur.brandeland@...ricsson.com>,
	"Guzman Lugo, Fernadndo" <fernando.lugo@...com>,
	Rusty Russell <rusty@...tcorp.com.au>,
	Ohad Ben-Cohen <ohad@...ery.com>,
	virtualization@...ts.linux-foundation.org,
	linux-kernel@...r.kernel.org
Subject: [PATCHv2] virtio: Don't access device data after unregistration.

From: Sjur Brændeland <sjur.brandeland@...ricsson.com>

Fix panic in virtio.c when CONFIG_DEBUG_SLAB is set.
device_unregister() drops reference to device so put_device()
could invoke release callback. In this case the release
callback will free the device. Make sure we don't access
device after unregister by fetching the device index
before calling unregister.

Signed-off-by: Sjur Brændeland <sjur.brandeland@...ricsson.com>
cc: Guzman Lugo, Fernadndo <fernando.lugo@...com>
cc: Michael S. Tsirkin <mst@...hat.com>
cc: Rusty Russell <rusty@...tcorp.com.au>
cc: Ohad Ben-Cohen <ohad@...ery.com>
cc: virtualization@...ts.linux-foundation.org
cc: linux-kernel@...r.kernel.org
---
 drivers/virtio/virtio.c |    9 ++++++++-
 1 files changed, 8 insertions(+), 1 deletions(-)

diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index c3b3f7f..faee112 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -225,8 +225,15 @@ EXPORT_SYMBOL_GPL(register_virtio_device);
 
 void unregister_virtio_device(struct virtio_device *dev)
 {
+	/*
+	 * device_unregister() drops reference to device so put_device could
+	 * invoke release callback. In case that callback will free the device,
+	 * make sure we don't access device after this call.
+	 */
+
+	int index = dev->index;
 	device_unregister(&dev->dev);
-	ida_simple_remove(&virtio_index_ida, dev->index);
+	ida_simple_remove(&virtio_index_ida, index);
 }
 EXPORT_SYMBOL_GPL(unregister_virtio_device);
 
-- 
1.7.5.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/