On Tue, Mar 1, 2022 at 9:26 AM Yi Wang <wang.yi59 at zte.com.cn> wrote:> > From: Zhang Min <zhang.min9 at zte.com.cn> > > When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device > and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, > triggering use-after-free. > > Call Trace of unbinding driver free vp_vdpa : > do_syscall_64 > vfs_write > kernfs_fop_write_iter > device_release_driver_internal > pci_device_remove > vp_vdpa_remove > vdpa_unregister_device > kobject_release > device_release > kfree > > Call Trace of dereference vp_vdpa->mdev.pci_dev: > vp_modern_remove > pci_release_selected_regions > pci_release_region > pci_resource_len > pci_resource_end > (dev)->resource[(bar)].end > > Signed-off-by: Zhang Min <zhang.min9 at zte.com.cn> > Signed-off-by: Yi Wang <wang.yi59 at zte.com.cn>Acked-by: Jason Wang <jasowang at redhat.com>> --- > drivers/vdpa/virtio_pci/vp_vdpa.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/vdpa/virtio_pci/vp_vdpa.c b/drivers/vdpa/virtio_pci/vp_vdpa.c > index a57e381e830b..cce101e6a940 100644 > --- a/drivers/vdpa/virtio_pci/vp_vdpa.c > +++ b/drivers/vdpa/virtio_pci/vp_vdpa.c > @@ -533,8 +533,8 @@ static void vp_vdpa_remove(struct pci_dev *pdev) > { > struct vp_vdpa *vp_vdpa = pci_get_drvdata(pdev); > > - vdpa_unregister_device(&vp_vdpa->vdpa); > vp_modern_remove(&vp_vdpa->mdev); > + vdpa_unregister_device(&vp_vdpa->vdpa); > } > > static struct pci_driver vp_vdpa_driver = { > -- > 2.27.0 >
Stefano Garzarella
2022-Mar-01 08:05 UTC
[PATCH] vdpa: fix use-after-free on vp_vdpa_remove
On Tue, Mar 1, 2022 at 2:26 AM Yi Wang <wang.yi59 at zte.com.cn> wrote:> > From: Zhang Min <zhang.min9 at zte.com.cn> > > When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device > and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, > triggering use-after-free. > > Call Trace of unbinding driver free vp_vdpa : > do_syscall_64 > vfs_write > kernfs_fop_write_iter > device_release_driver_internal > pci_device_remove > vp_vdpa_remove > vdpa_unregister_device > kobject_release > device_release > kfree > > Call Trace of dereference vp_vdpa->mdev.pci_dev: > vp_modern_remove > pci_release_selected_regions > pci_release_region > pci_resource_len > pci_resource_end > (dev)->resource[(bar)].endWe can add the fixes tag: Fixes: 64b9f64f80a6 ("vdpa: introduce virtio pci driver")> > Signed-off-by: Zhang Min <zhang.min9 at zte.com.cn> > Signed-off-by: Yi Wang <wang.yi59 at zte.com.cn> > --- > drivers/vdpa/virtio_pci/vp_vdpa.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/vdpa/virtio_pci/vp_vdpa.c b/drivers/vdpa/virtio_pci/vp_vdpa.c > index a57e381e830b..cce101e6a940 100644 > --- a/drivers/vdpa/virtio_pci/vp_vdpa.c > +++ b/drivers/vdpa/virtio_pci/vp_vdpa.c > @@ -533,8 +533,8 @@ static void vp_vdpa_remove(struct pci_dev *pdev) > { > struct vp_vdpa *vp_vdpa = pci_get_drvdata(pdev); > > - vdpa_unregister_device(&vp_vdpa->vdpa); > vp_modern_remove(&vp_vdpa->mdev); > + vdpa_unregister_device(&vp_vdpa->vdpa); > } > > static struct pci_driver vp_vdpa_driver = { > -- > 2.27.0 >The patch LGTM: Reviewed-by: Stefano Garzarella <sgarzare at redhat.com>
From: Zhang Min <zhang.min9 at zte.com.cn>
When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device
and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove,
triggering use-after-free.
Call Trace of unbinding driver free vp_vdpa :
do_syscall_64
vfs_write
kernfs_fop_write_iter
device_release_driver_internal
pci_device_remove
vp_vdpa_remove
vdpa_unregister_device
kobject_release
device_release
kfree
Call Trace of dereference vp_vdpa->mdev.pci_dev:
vp_modern_remove
pci_release_selected_regions
pci_release_region
pci_resource_len
pci_resource_end
(dev)->resource[(bar)].end
Signed-off-by: Zhang Min <zhang.min9 at zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59 at zte.com.cn>
---
drivers/vdpa/virtio_pci/vp_vdpa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vdpa/virtio_pci/vp_vdpa.c
b/drivers/vdpa/virtio_pci/vp_vdpa.c
index a57e381e830b..cce101e6a940 100644
--- a/drivers/vdpa/virtio_pci/vp_vdpa.c
+++ b/drivers/vdpa/virtio_pci/vp_vdpa.c
@@ -533,8 +533,8 @@ static void vp_vdpa_remove(struct pci_dev *pdev)
{
struct vp_vdpa *vp_vdpa = pci_get_drvdata(pdev);
- vdpa_unregister_device(&vp_vdpa->vdpa);
vp_modern_remove(&vp_vdpa->mdev);
+ vdpa_unregister_device(&vp_vdpa->vdpa);
}
static struct pci_driver vp_vdpa_driver = {
--
2.27.0