Skip to contentSkip to conversation

PCI: hv: potential use after free

PATCH In review Dan Carpenter 2 participants 3 messages Feb 27, 2016 – Feb 29, 2016

Subsystems (2)
Kernel janitors PCI
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 PCI: hv: potential use after free

If we throw away the very last item on the list, then we could end up with a use after free of "dr".

Fixes 15ca17645f19 ('PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs')
Signed-off-by Dan Carpenter <[email protected]>
drivers/pci/host/pci-hyperv.c +1 -0
index 9391dee..9b66ffe 100644
@@ -1397,6 +1397,7 @@ static void pci_devices_present_work(struct work_struct *work)
 		/* Throw this away if the list still has stuff in it. */
 		if (!list_empty(&hbus->dr_list)) {
 			kfree(dr);
+			dr = NULL;
 			continue;
 		}
 	}
#1 lore raw
Quoted 30 lines

-----Original Message-----
From: Dan Carpenter [mailto:[email protected]]
Sent: Saturday, February 27, 2016 2:44 AM
To: KY Srinivasan <[email protected]>; Jake Oshins <[email protected]>
Cc: Haiyang Zhang <[email protected]>; Bjorn Helgaas <[email protected]>; [email protected]; linux- [email protected]; [email protected]; kernel- [email protected]
Subject: [patch] PCI: hv: potential use after free

If we throw away the very last item on the list, then we could end up with a use after free of "dr".

Fixes 15ca17645f19 ('PCI: hv: Add paravirtual PCI front-end for Microsoft

Hyper-V VMs')

Signed-off-by Dan Carpenter <[email protected]>
drivers/pci/host/pci-hyperv.c +1 -0
index 9391dee..9b66ffe 100644
@@ -1397,6 +1397,7 @@ static void pci_devices_present_work(struct
 work_struct *work)
 		/* Throw this away if the list still has stuff in it. */
 		if (!list_empty(&hbus->dr_list)) {
 			kfree(dr);
+			dr = NULL;
 			continue;
 		}
Quoted 1 line

}

Thanks for looking at this. I do truly appreciate it. But the code here removes dr from the list and then, before freeing it, checks to see that it was not the last entry in the list. The list lock is still held and the list is not empty even after removing dr from it.

(I suspect that you're going to tell me that I'm missing something here. Please do. I'll appreciate it even more.)

Thanks,
Jake