* [PATCH] um: virtio_uml: Fix use-after-free after put_device in probe
@ 2025-08-04 7:59 Miaoqian Lin
2025-08-25 8:52 ` Johannes Berg
0 siblings, 1 reply; 2+ messages in thread
From: Miaoqian Lin @ 2025-08-04 7:59 UTC (permalink / raw)
To: Richard Weinberger, Anton Ivanov, Johannes Berg, Benjamin Berg,
Tiwei Bie, Miaoqian Lin, linux-um, linux-kernel
When register_virtio_device() fails in virtio_uml_probe(),
the code sets vu_dev->registered = 1 even though
the device was not successfully registered.
This can lead to use-after-free or other issues.
Fixes: 04e5b1fb0183 ("um: virtio: Remove device on disconnect")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
arch/um/drivers/virtio_uml.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/um/drivers/virtio_uml.c b/arch/um/drivers/virtio_uml.c
index ad8d78fb1d9a..c402c4cc908a 100644
--- a/arch/um/drivers/virtio_uml.c
+++ b/arch/um/drivers/virtio_uml.c
@@ -1250,8 +1250,10 @@ static int virtio_uml_probe(struct platform_device *pdev)
device_set_wakeup_capable(&vu_dev->vdev.dev, true);
rc = register_virtio_device(&vu_dev->vdev);
- if (rc)
+ if (rc) {
put_device(&vu_dev->vdev.dev);
+ return rc;
+ }
vu_dev->registered = 1;
return rc;
--
2.25.1
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] um: virtio_uml: Fix use-after-free after put_device in probe
2025-08-04 7:59 [PATCH] um: virtio_uml: Fix use-after-free after put_device in probe Miaoqian Lin
@ 2025-08-25 8:52 ` Johannes Berg
0 siblings, 0 replies; 2+ messages in thread
From: Johannes Berg @ 2025-08-25 8:52 UTC (permalink / raw)
To: Miaoqian Lin, Richard Weinberger, Anton Ivanov, Benjamin Berg,
Tiwei Bie, linux-um, linux-kernel
On Mon, 2025-08-04 at 11:59 +0400, Miaoqian Lin wrote:
> When register_virtio_device() fails in virtio_uml_probe(),
> the code sets vu_dev->registered = 1 even though
> the device was not successfully registered.
> This can lead to use-after-free or other issues.
>
> Fixes: 04e5b1fb0183 ("um: virtio: Remove device on disconnect")
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
> ---
> arch/um/drivers/virtio_uml.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/arch/um/drivers/virtio_uml.c b/arch/um/drivers/virtio_uml.c
> index ad8d78fb1d9a..c402c4cc908a 100644
> --- a/arch/um/drivers/virtio_uml.c
> +++ b/arch/um/drivers/virtio_uml.c
> @@ -1250,8 +1250,10 @@ static int virtio_uml_probe(struct platform_device *pdev)
> device_set_wakeup_capable(&vu_dev->vdev.dev, true);
>
> rc = register_virtio_device(&vu_dev->vdev);
> - if (rc)
> + if (rc) {
> put_device(&vu_dev->vdev.dev);
> + return rc;
> + }
> vu_dev->registered = 1;
> return rc;
>
This should now statically 'return 0' at the end.
johannes
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-08-25 8:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-08-04 7:59 [PATCH] um: virtio_uml: Fix use-after-free after put_device in probe Miaoqian Lin
2025-08-25 8:52 ` Johannes Berg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®