From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752666AbcB2RV1 (ORCPT ); Mon, 29 Feb 2016 12:21:27 -0500 Received: from mail-by2on0136.outbound.protection.outlook.com ([207.46.100.136]:12905 "EHLO na01-by2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752095AbcB2RVX convert rfc822-to-8bit (ORCPT ); Mon, 29 Feb 2016 12:21:23 -0500 From: Jake Oshins To: Dan Carpenter , KY Srinivasan CC: Haiyang Zhang , Bjorn Helgaas , "devel@linuxdriverproject.org" , "linux-pci@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "kernel-janitors@vger.kernel.org" Subject: RE: [patch] PCI: hv: potential use after free Thread-Topic: [patch] PCI: hv: potential use after free Thread-Index: AQHRcUvMHrw53xaKY0eyaZZMr+iuPJ9DR7bg Date: Mon, 29 Feb 2016 17:21:18 +0000 Message-ID: References: <20160227104357.GA14086@mwanda> In-Reply-To: <20160227104357.GA14086@mwanda> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8::563] x-ms-office365-filtering-correlation-id: c9d6b4fd-95c6-44d9-ff14-08d3412cbcb0 x-microsoft-exchange-diagnostics: 1;DM2PR0301MB0781;5:b6WTRHc+NALscxLVa/HY22PMQ+dW3wFPq+4lB1f7L5WNqwlvuABDse9ggsQFEe7y3FXDczeEW2gb/kY32/ASAwKs2/z9xxplAOhZPSaBMXef/kAmBADowRAfBxhyae1Ku8dcGdp7rZ/4tK9kamaKpQ==;24:Iz1hKDTohWz3igzpRdNXm/7nh3tf7ckCmHDZa+R+jmPrhaJBXolvH3Amt+sZDwtUBHduUb7uMFzq+dteAkfjqxo1FG2GJl+h/taLUVSAuiA= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR0301MB0781; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(61425038)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(61426038)(61427038);SRVR:DM2PR0301MB0781;BCL:0;PCL:0;RULEID:;SRVR:DM2PR0301MB0781; x-forefront-prvs: 0867F4F1AA x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(6009001)(52604005)(164054003)(377454003)(13464003)(5005710100001)(1220700001)(10290500002)(5004730100002)(40100003)(122556002)(10400500002)(3660700001)(74316001)(86362001)(5008740100001)(1096002)(50986999)(87936001)(2561002)(76176999)(2421001)(54356999)(5001960100003)(3280700002)(6116002)(99286002)(19580405001)(5003600100002)(19580395003)(5001770100001)(2906002)(1511001)(33656002)(189998001)(8990500004)(77096005)(5002640100001)(10090500001)(102836003)(106116001)(92566002)(2900100001)(2950100001)(11100500001)(586003)(4001450100002)(3826002);DIR:OUT;SFP:1102;SCL:1;SRVR:DM2PR0301MB0781;H:DM2PR0301MB1232.namprd03.prod.outlook.com;FPR:;SPF:None;MLV:sfv;LANG:en; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Feb 2016 17:21:18.7735 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0301MB0781 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > -----Original Message----- > From: Dan Carpenter [mailto:dan.carpenter@oracle.com] > Sent: Saturday, February 27, 2016 2:44 AM > To: KY Srinivasan ; Jake Oshins > > Cc: Haiyang Zhang ; Bjorn Helgaas > ; devel@linuxdriverproject.org; linux- > pci@vger.kernel.org; linux-kernel@vger.kernel.org; kernel- > janitors@vger.kernel.org > Subject: [patch] PCI: hv: potential use after free > > If we throw away the very last item on the list, then we could end up > with a use after free of "dr". > > Fixes: 15ca17645f19 ('PCI: hv: Add paravirtual PCI front-end for Microsoft > Hyper-V VMs') > Signed-off-by: Dan Carpenter > > diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c > index 9391dee..9b66ffe 100644 > --- a/drivers/pci/host/pci-hyperv.c > +++ b/drivers/pci/host/pci-hyperv.c > @@ -1397,6 +1397,7 @@ static void pci_devices_present_work(struct > work_struct *work) > /* Throw this away if the list still has stuff in it. */ > if (!list_empty(&hbus->dr_list)) { > kfree(dr); > + dr = NULL; > continue; > } > } Thanks for looking at this. I do truly appreciate it. But the code here removes dr from the list and then, before freeing it, checks to see that it was not the last entry in the list. The list lock is still held and the list is not empty even after removing dr from it. (I suspect that you're going to tell me that I'm missing something here. Please do. I'll appreciate it even more.) Thanks, Jake