From: "Tian, Kevin" <kevin.tian@intel.com>
To: Alex Williamson <alex.williamson@redhat.com>
Cc: Matthew Rosato <mjrosato@linux.ibm.com>,
David Airlie <airlied@linux.ie>,
"dri-devel@lists.freedesktop.org"
<dri-devel@lists.freedesktop.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Kirti Wankhede <kwankhede@nvidia.com>,
Vineeth Vijayan <vneethv@linux.ibm.com>,
Diana Craciun <diana.craciun@oss.nxp.com>,
Alexander Gordeev <agordeev@linux.ibm.com>,
Longfang Liu <liulongfang@huawei.com>,
Christoph Hellwig <hch@infradead.org>,
"Liu, Yi L" <yi.l.liu@intel.com>,
"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
Leon Romanovsky <leon@kernel.org>,
Halil Pasic <pasic@linux.ibm.com>, Jason Gunthorpe <jgg@ziepe.ca>,
Christian Borntraeger <borntraeger@linux.ibm.com>,
"intel-gfx@lists.freedesktop.org"
<intel-gfx@lists.freedesktop.org>,
"Wang, Zhi A" <zhi.a.wang@intel.com>,
Tony Krowiak <akrowiak@linux.ibm.com>,
Eric Farman <farman@linux.ibm.com>,
Vasily Gorbik <gor@linux.ibm.com>,
"linux-s390@vger.kernel.org" <linux-s390@vger.kernel.org>,
Heiko Carstens <hca@linux.ibm.com>,
Eric Auger <eric.auger@redhat.com>,
Harald Freudenberger <freude@linux.ibm.com>,
"Vivi, Rodrigo" <rodrigo.vivi@intel.com>,
"intel-gvt-dev@lists.freedesktop.org"
<intel-gvt-dev@lists.freedesktop.org>,
Jason Herne <jjherne@linux.ibm.com>,
Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>,
Yishai Hadas <yishaih@nvidia.com>,
Cornelia Huck <cohuck@redhat.com>,
Peter Oberparleiter <oberpar@linux.ibm.com>,
Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>,
Sven Schnelle <svens@linux.ibm.com>,
Abhishek Sahu <abhsahu@nvidia.com>
Subject: RE: [PATCH v3 06/15] vfio/mtty: Use the new device life cycle helpers
Date: Tue, 20 Sep 2022 22:52:57 +0000 [thread overview]
Message-ID: <BN9PR11MB5276F8872ABDFAEB8A8C2AE78C4C9@BN9PR11MB5276.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20220920131723.2541b7e8.alex.williamson@redhat.com>
> From: Alex Williamson <alex.williamson@redhat.com>
> Sent: Wednesday, September 21, 2022 3:17 AM
>
> On Fri, 9 Sep 2022 18:22:38 +0800
> Kevin Tian <kevin.tian@intel.com> wrote:
>
> > From: Yi Liu <yi.l.liu@intel.com>
> >
> > and manage available ports inside @init/@release.
> >
> > Signed-off-by: Yi Liu <yi.l.liu@intel.com>
> > Signed-off-by: Kevin Tian <kevin.tian@intel.com>
> > Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
> > ---
> > samples/vfio-mdev/mtty.c | 67 +++++++++++++++++++++++-----------------
> > 1 file changed, 39 insertions(+), 28 deletions(-)
> >
> > diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> > index f42a59ed2e3f..41301d50b247 100644
> > --- a/samples/vfio-mdev/mtty.c
> > +++ b/samples/vfio-mdev/mtty.c
> ...
> > +static int mtty_probe(struct mdev_device *mdev)
> > +{
> > + struct mdev_state *mdev_state;
> > + int ret;
> > +
> > + mdev_state = vfio_alloc_device(mdev_state, vdev, &mdev->dev,
> > + &mtty_dev_ops);
> > + if (IS_ERR(mdev_state))
> > + return PTR_ERR(mdev_state);
> >
> > ret = vfio_register_emulated_iommu_dev(&mdev_state->vdev);
> > if (ret)
> > - goto err_vconfig;
> > + goto err_put_vdev;
> > dev_set_drvdata(&mdev->dev, mdev_state);
> > return 0;
> >
> > -err_vconfig:
> > - kfree(mdev_state->vconfig);
> > -err_state:
> > - vfio_uninit_group_dev(&mdev_state->vdev);
> > - kfree(mdev_state);
> > -err_nr_ports:
> > - atomic_add(nr_ports, &mdev_avail_ports);
> > +err_put_vdev:
> > + vfio_put_device(&mdev_state->vdev);
> > return ret;
> > }
> >
> > +static void mtty_release_dev(struct vfio_device *vdev)
> > +{
> > + struct mdev_state *mdev_state =
> > + container_of(vdev, struct mdev_state, vdev);
> > +
> > + kfree(mdev_state->vconfig);
> > + vfio_free_device(vdev);
> > + atomic_add(mdev_state->nr_ports, &mdev_avail_ports);
>
> I must be missing something, isn't this a use-after-free?
Yes, it's a use-after-free indeed. Thanks for catching it!
>
> mdev_state is allocated via vfio_alloc_device(), where vdev is the
> first entry in that structure, so this is equivalent to
> kvfree(mdev_state). mbochs has the same issue. mdpy and vfio-ap
> adjust global counters after vfio_free_device(), which I think muddies
> the situation. Shouldn't we look suspiciously at any .release callback
> where vfio_free_device() isn't the last thing executed? Thanks,
>
Yes. I'll scrutinize it again. To be consistent I'll make sure the free
is the last line in all .release callbacks though not required for
some (e.g. mdpy and vfio-ap).
next prev parent reply other threads:[~2022-09-20 22:53 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-09 10:22 [PATCH v3 00/15] Tidy up vfio_device life cycle Kevin Tian
2022-09-09 10:22 ` [PATCH v3 01/15] vfio: Add helpers for unifying " Kevin Tian
2022-09-09 8:23 ` Ethan Zhao
2022-09-09 8:42 ` Tian, Kevin
2022-09-09 23:53 ` Jason Gunthorpe
2022-09-09 10:22 ` [PATCH v3 02/15] vfio/pci: Use the new device life cycle helpers Kevin Tian
2022-09-09 10:22 ` [PATCH v3 03/15] vfio/mlx5: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 04/15] vfio/hisi_acc: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 05/15] vfio/mdpy: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 06/15] vfio/mtty: " Kevin Tian
2022-09-20 19:17 ` Alex Williamson
2022-09-20 22:52 ` Tian, Kevin [this message]
2022-09-09 10:22 ` [PATCH v3 07/15] vfio/mbochs: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 08/15] drm/i915/gvt: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 09/15] vfio/ap: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 10/15] vfio/fsl-mc: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 11/15] vfio/platform: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 12/15] vfio/amba: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 13/15] vfio/ccw: " Kevin Tian
2022-09-09 10:22 ` [PATCH v3 14/15] vfio: Rename vfio_device_put() and vfio_device_try_get() Kevin Tian
2022-09-09 10:22 ` [PATCH v3 15/15] vfio: Add struct device to vfio_device Kevin Tian
2022-09-20 20:26 ` Alex Williamson
2022-09-20 22:55 ` Tian, Kevin
2022-09-21 16:10 ` Jason Gunthorpe
2022-09-22 5:18 ` Tian, Kevin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=BN9PR11MB5276F8872ABDFAEB8A8C2AE78C4C9@BN9PR11MB5276.namprd11.prod.outlook.com \
--to=kevin.tian@intel.com \
--cc=abhsahu@nvidia.com \
--cc=agordeev@linux.ibm.com \
--cc=airlied@linux.ie \
--cc=akrowiak@linux.ibm.com \
--cc=alex.williamson@redhat.com \
--cc=borntraeger@linux.ibm.com \
--cc=cohuck@redhat.com \
--cc=diana.craciun@oss.nxp.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=eric.auger@redhat.com \
--cc=farman@linux.ibm.com \
--cc=freude@linux.ibm.com \
--cc=gor@linux.ibm.com \
--cc=hca@linux.ibm.com \
--cc=hch@infradead.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=intel-gvt-dev@lists.freedesktop.org \
--cc=jgg@ziepe.ca \
--cc=jjherne@linux.ibm.com \
--cc=kvm@vger.kernel.org \
--cc=kwankhede@nvidia.com \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=liulongfang@huawei.com \
--cc=mjrosato@linux.ibm.com \
--cc=oberpar@linux.ibm.com \
--cc=pasic@linux.ibm.com \
--cc=rodrigo.vivi@intel.com \
--cc=shameerali.kolothum.thodi@huawei.com \
--cc=svens@linux.ibm.com \
--cc=tvrtko.ursulin@linux.intel.com \
--cc=vneethv@linux.ibm.com \
--cc=yi.l.liu@intel.com \
--cc=yishaih@nvidia.com \
--cc=zhi.a.wang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).