Zhang Min 4b1743bc71 vdpa: fix use-after-free on vp_vdpa_remove ... [ Upstream commit eb057b44db ] When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free. Call Trace of unbinding driver free vp_vdpa : do_syscall_64 vfs_write kernfs_fop_write_iter device_release_driver_internal pci_device_remove vp_vdpa_remove vdpa_unregister_device kobject_release device_release kfree Call Trace of dereference vp_vdpa->mdev.pci_dev: vp_modern_remove pci_release_selected_regions pci_release_region pci_resource_len pci_resource_end (dev)->resource[(bar)].end Signed-off-by: Zhang Min <zhang.min9@zte.com.cn> Signed-off-by: Yi Wang <wang.yi59@zte.com.cn> Link: https://lore.kernel.org/r/20220301091059.46869-1-wang.yi59@zte.com.cn Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Fixes: 64b9f64f80 ("vdpa: introduce virtio pci driver") Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-03-16 14:23:36 +01:00
..
ifcvf	ifcvf/vDPA: fix misuse virtio-net device config size for blk dev	2022-01-27 11:05:06 +01:00
mlx5	vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command	2022-03-16 14:23:35 +01:00
vdpa_sim	vdpa_sim: avoid putting an uninitialized iova_domain	2021-12-01 09:04:55 +01:00
vdpa_user	vduse: Fix returning wrong type in vduse_domain_alloc_iova()	2022-03-16 14:23:36 +01:00
virtio_pci	vdpa: fix use-after-free on vp_vdpa_remove	2022-03-16 14:23:36 +01:00
Kconfig	vduse: Introduce VDUSE - vDPA Device in Userspace	2021-09-06 07:20:58 -04:00
Makefile	vduse: Introduce VDUSE - vDPA Device in Userspace	2021-09-06 07:20:58 -04:00
vdpa.c	vdpa: Consider device id larger than 31	2021-12-22 09:32:39 +01:00