* [PATCH next] vfio/xe: Fix use after free in xe_vfio_pci_alloc_file()
@ 2025-12-05 11:39 Dan Carpenter
2025-12-05 12:31 ` Michal Wajdeczko
2025-12-12 4:07 ` Tian, Kevin
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2025-12-05 11:39 UTC (permalink / raw)
To: Michał Winiarski
Cc: Jason Gunthorpe, Yishai Hadas, Shameer Kolothum, Kevin Tian,
Alex Williamson, Rodrigo Vivi, kvm, intel-xe, linux-kernel,
kernel-janitors
This code frees "migf" and then dereferences it on the next line to get
the error code. Preserve the error code before freeing the pointer.
Fixes: 2e38c50ae492 ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/vfio/pci/xe/main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/vfio/pci/xe/main.c b/drivers/vfio/pci/xe/main.c
index 0156b53c678b..8e1595e00e18 100644
--- a/drivers/vfio/pci/xe/main.c
+++ b/drivers/vfio/pci/xe/main.c
@@ -250,6 +250,7 @@ xe_vfio_pci_alloc_file(struct xe_vfio_pci_core_device *xe_vdev,
struct xe_vfio_pci_migration_file *migf;
const struct file_operations *fops;
int flags;
+ int ret;
migf = kzalloc(sizeof(*migf), GFP_KERNEL_ACCOUNT);
if (!migf)
@@ -259,8 +260,9 @@ xe_vfio_pci_alloc_file(struct xe_vfio_pci_core_device *xe_vdev,
flags = type == XE_VFIO_FILE_SAVE ? O_RDONLY : O_WRONLY;
migf->filp = anon_inode_getfile("xe_vfio_mig", fops, migf, flags);
if (IS_ERR(migf->filp)) {
+ ret = PTR_ERR(migf->filp);
kfree(migf);
- return ERR_CAST(migf->filp);
+ return ERR_PTR(ret);
}
mutex_init(&migf->lock);
--
2.51.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH next] vfio/xe: Fix use after free in xe_vfio_pci_alloc_file()
2025-12-05 11:39 [PATCH next] vfio/xe: Fix use after free in xe_vfio_pci_alloc_file() Dan Carpenter
@ 2025-12-05 12:31 ` Michal Wajdeczko
2025-12-12 4:07 ` Tian, Kevin
1 sibling, 0 replies; 3+ messages in thread
From: Michal Wajdeczko @ 2025-12-05 12:31 UTC (permalink / raw)
To: Dan Carpenter, Michał Winiarski
Cc: Jason Gunthorpe, Yishai Hadas, Shameer Kolothum, Kevin Tian,
Alex Williamson, Rodrigo Vivi, kvm, intel-xe, linux-kernel,
kernel-janitors
On 12/5/2025 12:39 PM, Dan Carpenter wrote:
> This code frees "migf" and then dereferences it on the next line to get
> the error code. Preserve the error code before freeing the pointer.
>
> Fixes: 2e38c50ae492 ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
> ---
> drivers/vfio/pci/xe/main.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/pci/xe/main.c b/drivers/vfio/pci/xe/main.c
> index 0156b53c678b..8e1595e00e18 100644
> --- a/drivers/vfio/pci/xe/main.c
> +++ b/drivers/vfio/pci/xe/main.c
> @@ -250,6 +250,7 @@ xe_vfio_pci_alloc_file(struct xe_vfio_pci_core_device *xe_vdev,
> struct xe_vfio_pci_migration_file *migf;
> const struct file_operations *fops;
> int flags;
> + int ret;
>
> migf = kzalloc(sizeof(*migf), GFP_KERNEL_ACCOUNT);
> if (!migf)
> @@ -259,8 +260,9 @@ xe_vfio_pci_alloc_file(struct xe_vfio_pci_core_device *xe_vdev,
> flags = type == XE_VFIO_FILE_SAVE ? O_RDONLY : O_WRONLY;
> migf->filp = anon_inode_getfile("xe_vfio_mig", fops, migf, flags);
> if (IS_ERR(migf->filp)) {
> + ret = PTR_ERR(migf->filp);
> kfree(migf);
> - return ERR_CAST(migf->filp);
> + return ERR_PTR(ret);
> }
>
> mutex_init(&migf->lock);
^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: [PATCH next] vfio/xe: Fix use after free in xe_vfio_pci_alloc_file()
2025-12-05 11:39 [PATCH next] vfio/xe: Fix use after free in xe_vfio_pci_alloc_file() Dan Carpenter
2025-12-05 12:31 ` Michal Wajdeczko
@ 2025-12-12 4:07 ` Tian, Kevin
1 sibling, 0 replies; 3+ messages in thread
From: Tian, Kevin @ 2025-12-12 4:07 UTC (permalink / raw)
To: Dan Carpenter, Winiarski, Michal
Cc: Jason Gunthorpe, Yishai Hadas, Shameer Kolothum, Alex Williamson,
Vivi, Rodrigo, kvm, intel-xe, linux-kernel, kernel-janitors
> From: Dan Carpenter <dan.carpenter@linaro.org>
> Sent: Friday, December 5, 2025 7:39 PM
>
> This code frees "migf" and then dereferences it on the next line to get
> the error code. Preserve the error code before freeing the pointer.
>
> Fixes: 2e38c50ae492 ("vfio/xe: Add device specific vfio_pci driver variant for
> Intel graphics")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-12-12 4:07 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-12-05 11:39 [PATCH next] vfio/xe: Fix use after free in xe_vfio_pci_alloc_file() Dan Carpenter
2025-12-05 12:31 ` Michal Wajdeczko
2025-12-12 4:07 ` Tian, Kevin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®