* [PATCH] ata: read ->revision before dropping pci_device reference
@ 2018-11-28 1:40 Pan Bian
2018-11-28 7:05 ` Christoph Hellwig
0 siblings, 1 reply; 2+ messages in thread
From: Pan Bian @ 2018-11-28 1:40 UTC (permalink / raw)
To: Bartlomiej Zolnierkiewicz, Jens Axboe; +Cc: linux-ide, linux-kernel, Pan Bian
pci_device->revision is read after dropping pci_device reference via
pci_dev_put, which may result in use-after-free bugs. To fix this, the
patch reads ->revision before dropping reference.
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
drivers/ata/pata_sis.c | 4 +++-
drivers/ata/pata_sl82c105.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/ata/pata_sis.c b/drivers/ata/pata_sis.c
index 626f989..01635bc 100644
--- a/drivers/ata/pata_sis.c
+++ b/drivers/ata/pata_sis.c
@@ -833,6 +833,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
u16 trueid;
u8 prefctl;
u8 idecfg;
+ u8 sbrev;
/* Try the second unmasking technique */
pci_read_config_byte(pdev, 0x4a, &idecfg);
@@ -846,9 +847,10 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
if (lpc_bridge == NULL)
break;
pci_read_config_byte(pdev, 0x49, &prefctl);
+ sbrev = lpc_bridge->revision;
pci_dev_put(lpc_bridge);
- if (lpc_bridge->revision == 0x10 && (prefctl & 0x80)) {
+ if (sbrev == 0x10 && (prefctl & 0x80)) {
chipset = &sis133_early;
break;
}
diff --git a/drivers/ata/pata_sl82c105.c b/drivers/ata/pata_sl82c105.c
index 4935f61f..476438e 100644
--- a/drivers/ata/pata_sl82c105.c
+++ b/drivers/ata/pata_sl82c105.c
@@ -264,6 +264,7 @@ static struct ata_port_operations sl82c105_port_ops = {
static int sl82c105_bridge_revision(struct pci_dev *pdev)
{
struct pci_dev *bridge;
+ u8 rev;
/*
* The bridge should be part of the same device, but function 0.
@@ -285,8 +286,9 @@ static int sl82c105_bridge_revision(struct pci_dev *pdev)
/*
* We need to find function 0's revision, not function 1
*/
+ rev = bridge->revision;
pci_dev_put(bridge);
- return bridge->revision;
+ return rev;
}
static void sl82c105_fixup(struct pci_dev *pdev)
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ata: read ->revision before dropping pci_device reference
2018-11-28 1:40 [PATCH] ata: read ->revision before dropping pci_device reference Pan Bian
@ 2018-11-28 7:05 ` Christoph Hellwig
0 siblings, 0 replies; 2+ messages in thread
From: Christoph Hellwig @ 2018-11-28 7:05 UTC (permalink / raw)
To: Pan Bian; +Cc: Bartlomiej Zolnierkiewicz, Jens Axboe, linux-ide, linux-kernel
Looks good,
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-11-28 7:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-11-28 1:40 [PATCH] ata: read ->revision before dropping pci_device reference Pan Bian
2018-11-28 7:05 ` Christoph Hellwig
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).