Zhang Min eb057b44db vdpa: fix use-after-free on vp_vdpa_remove ... When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free. Call Trace of unbinding driver free vp_vdpa : do_syscall_64 vfs_write kernfs_fop_write_iter device_release_driver_internal pci_device_remove vp_vdpa_remove vdpa_unregister_device kobject_release device_release kfree Call Trace of dereference vp_vdpa->mdev.pci_dev: vp_modern_remove pci_release_selected_regions pci_release_region pci_resource_len pci_resource_end (dev)->resource[(bar)].end Signed-off-by: Zhang Min <zhang.min9@zte.com.cn> Signed-off-by: Yi Wang <wang.yi59@zte.com.cn> Link: https://lore.kernel.org/r/20220301091059.46869-1-wang.yi59@zte.com.cn Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Fixes: 64b9f64f80 ("vdpa: introduce virtio pci driver") Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>		2022-03-06 06:06:50 -05:00
..
alibaba	vdpa: Provide interface to read driver features	2022-01-14 18:50:53 -05:00
ifcvf	vdpa: Provide interface to read driver features	2022-01-14 18:50:53 -05:00
mlx5	vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command	2022-03-04 11:56:34 -05:00
vdpa_sim	vdpa/vdpa_sim_net: Report max device capabilities	2022-01-14 18:50:54 -05:00
vdpa_user	vduse: Fix returning wrong type in vduse_domain_alloc_iova()	2022-03-04 11:56:34 -05:00
virtio_pci	vdpa: fix use-after-free on vp_vdpa_remove	2022-03-06 06:06:50 -05:00
Kconfig	eni_vdpa: add vDPA driver for Alibaba ENI	2021-11-01 05:23:41 -04:00
Makefile	eni_vdpa: add vDPA driver for Alibaba ENI	2021-11-01 05:23:41 -04:00
vdpa.c	vdpa: factor out vdpa_set_features_unlocked for vdpa internal use	2022-03-04 11:56:33 -05:00