AW: [Resend] [PATCH v3] usb: xhci-pci: reorder removal to avoid use-after-free

["Schmid, Carsten" <Carsten_Schmid@mentor.com>]

> On 22-08-19 17:23, Mathias Nyman wrote:
> > On 16.8.2019 12.03, Schmid, Carsten wrote:
> >> On driver removal, the platform_device_unregister call
> >> attached through devm_add_action_or_reset was executed
> >> after usb_hcd_pci_remove.
> >> This lead to a use-after-free for the iomem resource of
> >> the xhci-ext-caps driver in the platform removal
> >> because the parent of the resource was freed earlier.
> >>
> >> Fix this by reordering of the removal sequence.
> >>
> >
> > Could all this be avoided if usb_hcd_pci_probe()
> > used managed device resources as well?
> > (using devm_request_mem_region(), and devm_ioremap_nocache())
> >
> > This way the iomem resource would be added to the same devres list
> > as the platform_unregister_call, and the iomem resource should be
> > released after the platform_device_unregister as devres_release_all()
> > releases the resources in reverse order.
> 
> Yes I believe that that would work.
> 
I don't think so, because xhci_create_intel_xhci_sw_pdev registers it's 
resource through platform_device_add_resources which does not use devm_.

The only thing what is done through devm in xhci_create_intel_xhci_sw_pdev is
ret = devm_add_action_or_reset(...)

Carsten