From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1754913AbdDDU0s (ORCPT <rfc822;w@1wt.eu>);
        Tue, 4 Apr 2017 16:26:48 -0400
Received: from imap0.codethink.co.uk ([185.43.218.159]:50089 "EHLO
        imap0.codethink.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1753876AbdDDU0r (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 4 Apr 2017 16:26:47 -0400
Message-ID: <1491337598.10415.10.camel@codethink.co.uk>
Subject: Re: [PATCH 4.4 74/76] serial: 8250_pci: Detach low-level driver
 during PCI error recovery
From: Ben Hutchings <ben.hutchings@codethink.co.uk>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        Sasha Levin <alexander.levin@verizon.com>,
        Sumit Semwal <sumit.semwal@linaro.org>
Date: Tue, 04 Apr 2017 21:26:38 +0100
In-Reply-To: <20170328122602.961021667@linuxfoundation.org>
References: <20170328122559.966310440@linuxfoundation.org>
         <20170328122602.961021667@linuxfoundation.org>
Organization: Codethink Ltd.
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.12.9-1+b1 
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, 2017-03-28 at 14:31 +0200, Greg Kroah-Hartman wrote:
[...]
>  static void serial8250_io_resume(struct pci_dev *dev)
>  {
>  	struct serial_private *priv = pci_get_drvdata(dev);
> +	const struct pciserial_board *board;
>  
> -	if (priv)
> -		pciserial_resume_ports(priv);
> +	if (!priv)
> +		return;
> +
> +	board = priv->board;
> +	kfree(priv);
> +	priv = pciserial_init_ports(dev, board);
> +
> +	if (!IS_ERR(priv)) {
> +		pci_set_drvdata(dev, priv);
> +	}
>  }

On error, this leaves drvdata as a dangling pointer.  Removing the
device or driver will then cause a use-after-free.  (And setting drvdata
to NULL isn't enough to fix this as there is no null pointer check in
pciserial_remove_ports().)

Ben.

-- 
Ben Hutchings
Software Developer, Codethink Ltd.