Re: [PATCH] xen-pciback: fix up cleanup path when alloc fails

From: David Vrabel <david.vrabel@citrix.com>
To: Doug Goldstein <cardoe@cardoe.com>, xen-devel@lists.xenproject.org
Cc: Wei Liu <wei.liu2@citrix.com>,
	Jonathan Creekmore <jonathan.creekmore@gmail.com>,
	linux-kernel@vger.kernel.org,
	Paul Durrant <paul.durrant@citrix.com>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>
Subject: Re: [PATCH] xen-pciback: fix up cleanup path when alloc fails
Date: Wed, 2 Dec 2015 10:35:16 +0000	[thread overview]
Message-ID: <565EC964.3020006__21964.3114869998$1449052613$gmane$org@citrix.com> (raw)
In-Reply-To: <1448569959-7245-1-git-send-email-cardoe@cardoe.com>

On 26/11/15 20:32, Doug Goldstein wrote:
> When allocating a pciback device fails, avoid the possibility of a
> use after free.

We should not require clearing drvdata for correctness.  We should
ensure we retain drvdata for as long as it is needed.

I note that pcistub_device_release() has:

	kfree(dev_data);
	pci_set_drvdata(dev, NULL);

	/* Clean-up the device */
	xen_pcibk_config_free_dyn_fields(dev);
	xen_pcibk_config_free_dev(dev);

Which should (at a minimum) be reordered to move the kfree(dev_data) to
after the calls that require it

David