From: Alex Williamson <alex.williamson@redhat.com>
To: Kevin Tian <kevin.tian@intel.com>
Cc: Matthew Rosato <mjrosato@linux.ibm.com>,
David Airlie <airlied@linux.ie>,
dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
Kirti Wankhede <kwankhede@nvidia.com>,
Vineeth Vijayan <vneethv@linux.ibm.com>,
Diana Craciun <diana.craciun@oss.nxp.com>,
Alexander Gordeev <agordeev@linux.ibm.com>,
Longfang Liu <liulongfang@huawei.com>,
Christoph Hellwig <hch@infradead.org>,
Yi Liu <yi.l.liu@intel.com>,
kvm@vger.kernel.org, Leon Romanovsky <leon@kernel.org>,
Halil Pasic <pasic@linux.ibm.com>, Jason Gunthorpe <jgg@ziepe.ca>,
Christian Borntraeger <borntraeger@linux.ibm.com>,
intel-gfx@lists.freedesktop.org, Zhi Wang <zhi.a.wang@intel.com>,
Tony Krowiak <akrowiak@linux.ibm.com>,
Eric Farman <farman@linux.ibm.com>,
Vasily Gorbik <gor@linux.ibm.com>,
linux-s390@vger.kernel.org, Heiko Carstens <hca@linux.ibm.com>,
Eric Auger <eric.auger@redhat.com>,
Harald Freudenberger <freude@linux.ibm.com>,
Rodrigo Vivi <rodrigo.vivi@intel.com>,
intel-gvt-dev@lists.freedesktop.org,
Jason Herne <jjherne@linux.ibm.com>,
Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>,
Yishai Hadas <yishaih@nvidia.com>,
Cornelia Huck <cohuck@redhat.com>,
Peter Oberparleiter <oberpar@linux.ibm.com>,
Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>,
Sven Schnelle <svens@linux.ibm.com>,
Abhishek Sahu <abhsahu@nvidia.com>
Subject: Re: [PATCH v3 06/15] vfio/mtty: Use the new device life cycle helpers
Date: Tue, 20 Sep 2022 13:17:23 -0600 [thread overview]
Message-ID: <20220920131723.2541b7e8.alex.williamson@redhat.com> (raw)
In-Reply-To: <20220909102247.67324-7-kevin.tian@intel.com>
On Fri, 9 Sep 2022 18:22:38 +0800
Kevin Tian <kevin.tian@intel.com> wrote:
> From: Yi Liu <yi.l.liu@intel.com>
>
> and manage available ports inside @init/@release.
>
> Signed-off-by: Yi Liu <yi.l.liu@intel.com>
> Signed-off-by: Kevin Tian <kevin.tian@intel.com>
> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
> samples/vfio-mdev/mtty.c | 67 +++++++++++++++++++++++-----------------
> 1 file changed, 39 insertions(+), 28 deletions(-)
>
> diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> index f42a59ed2e3f..41301d50b247 100644
> --- a/samples/vfio-mdev/mtty.c
> +++ b/samples/vfio-mdev/mtty.c
...
> +static int mtty_probe(struct mdev_device *mdev)
> +{
> + struct mdev_state *mdev_state;
> + int ret;
> +
> + mdev_state = vfio_alloc_device(mdev_state, vdev, &mdev->dev,
> + &mtty_dev_ops);
> + if (IS_ERR(mdev_state))
> + return PTR_ERR(mdev_state);
>
> ret = vfio_register_emulated_iommu_dev(&mdev_state->vdev);
> if (ret)
> - goto err_vconfig;
> + goto err_put_vdev;
> dev_set_drvdata(&mdev->dev, mdev_state);
> return 0;
>
> -err_vconfig:
> - kfree(mdev_state->vconfig);
> -err_state:
> - vfio_uninit_group_dev(&mdev_state->vdev);
> - kfree(mdev_state);
> -err_nr_ports:
> - atomic_add(nr_ports, &mdev_avail_ports);
> +err_put_vdev:
> + vfio_put_device(&mdev_state->vdev);
> return ret;
> }
>
> +static void mtty_release_dev(struct vfio_device *vdev)
> +{
> + struct mdev_state *mdev_state =
> + container_of(vdev, struct mdev_state, vdev);
> +
> + kfree(mdev_state->vconfig);
> + vfio_free_device(vdev);
> + atomic_add(mdev_state->nr_ports, &mdev_avail_ports);
I must be missing something, isn't this a use-after-free?
mdev_state is allocated via vfio_alloc_device(), where vdev is the
first entry in that structure, so this is equivalent to
kvfree(mdev_state). mbochs has the same issue. mdpy and vfio-ap
adjust global counters after vfio_free_device(), which I think muddies
the situation. Shouldn't we look suspiciously at any .release callback
where vfio_free_device() isn't the last thing executed? Thanks,
Alex
next prev parent reply other threads:[~2022-09-20 19:17 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-09 10:22 [PATCH v3 00/15] Tidy up vfio_device life cycle Kevin Tian
2022-09-09 10:22 ` [PATCH v3 01/15] vfio: Add helpers for unifying " Kevin Tian
2022-09-09 8:23 ` Ethan Zhao
2022-09-09 8:42 ` Tian, Kevin
2022-09-09 23:53 ` Jason Gunthorpe
2022-09-09 10:22 ` [PATCH v3 02/15] vfio/pci: Use the new device life cycle helpers Kevin Tian
2022-09-09 10:22 ` [PATCH v3 03/15] vfio/mlx5: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 04/15] vfio/hisi_acc: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 05/15] vfio/mdpy: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 06/15] vfio/mtty: " Kevin Tian
2022-09-20 19:17 ` Alex Williamson [this message]
2022-09-20 22:52 ` Tian, Kevin
2022-09-09 10:22 ` [PATCH v3 07/15] vfio/mbochs: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 08/15] drm/i915/gvt: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 09/15] vfio/ap: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 10/15] vfio/fsl-mc: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 11/15] vfio/platform: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 12/15] vfio/amba: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 13/15] vfio/ccw: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 14/15] vfio: Rename vfio_device_put() and vfio_device_try_get() Kevin Tian
2022-09-09 10:22 ` [PATCH v3 15/15] vfio: Add struct device to vfio_device Kevin Tian
2022-09-20 20:26 ` Alex Williamson
2022-09-20 22:55 ` Tian, Kevin
2022-09-21 16:10 ` Jason Gunthorpe
2022-09-22 5:18 ` Tian, Kevin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220920131723.2541b7e8.alex.williamson@redhat.com \
--to=alex.williamson@redhat.com \
--cc=abhsahu@nvidia.com \
--cc=agordeev@linux.ibm.com \
--cc=airlied@linux.ie \
--cc=akrowiak@linux.ibm.com \
--cc=borntraeger@linux.ibm.com \
--cc=cohuck@redhat.com \
--cc=diana.craciun@oss.nxp.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=eric.auger@redhat.com \
--cc=farman@linux.ibm.com \
--cc=freude@linux.ibm.com \
--cc=gor@linux.ibm.com \
--cc=hca@linux.ibm.com \
--cc=hch@infradead.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=intel-gvt-dev@lists.freedesktop.org \
--cc=jgg@ziepe.ca \
--cc=jjherne@linux.ibm.com \
--cc=kevin.tian@intel.com \
--cc=kvm@vger.kernel.org \
--cc=kwankhede@nvidia.com \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=liulongfang@huawei.com \
--cc=mjrosato@linux.ibm.com \
--cc=oberpar@linux.ibm.com \
--cc=pasic@linux.ibm.com \
--cc=rodrigo.vivi@intel.com \
--cc=shameerali.kolothum.thodi@huawei.com \
--cc=svens@linux.ibm.com \
--cc=tvrtko.ursulin@linux.intel.com \
--cc=vneethv@linux.ibm.com \
--cc=yi.l.liu@intel.com \
--cc=yishaih@nvidia.com \
--cc=zhi.a.wang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).