Re: pci: kernel crash in bus_find_device

From: Francesco Ruggeri <fruggeri@arista.com>
To: Guenter Roeck <linux@roeck-us.net>
Cc: Greg KH <gregkh@linuxfoundation.org>,
	Francesco Ruggeri <fruggeri@aristanetworks.com>,
	linux-kernel@vger.kernel.org, Hannes Reinecke <hare@suse.de>
Subject: Re: pci: kernel crash in bus_find_device
Date: Tue, 3 Jun 2014 23:22:50 -0700	[thread overview]
Message-ID: <CA+HUmGgGuWbg8drsRYKN=OAD_WPYOjRh9tAZ0EXky1KNoVGa5Q@mail.gmail.com> (raw)
In-Reply-To: <20140604032533.GA22469@roeck-us.net>

>>
> Look for callers of bus_find_device. Unless I am missing something, only pci
> and scsi code call it with non-NULL 'start' argument, and the scsi use is
> limited to a walk through scsi devices for a proc file.
>
> Makes me wonder if the start argument should go away, and if pci and scsi
> should use another means to walk through devices.

I think that would be the correct approach.
In case of pci all functions using pci_get_device, pci_get_subsys or
pci_get_class (which call pci_get_dev_by_id/bus_find_device) to
iterate over the whole list using a non-NULL start argument would have
to be audited.
There seem to be quite a few of them using loops of the kind
while ((dev = pci_get_device( …, dev)) != NULL)
(and similarly for pci_get_subsys and pci_get_class) and they could
all be vulnerable if they try to resume their search from a device
that was unregistered.

Francesco

>
> Guenter