• Jubin Zhong's avatar
    PCI: Fix pci_slot_release() NULL pointer dereference · 4684709b
    Jubin Zhong authored
    If kobject_init_and_add() fails, pci_slot_release() is called to delete
    slot->list from parent->slots.  But slot->list hasn't been initialized
    yet, so we dereference a NULL pointer:
    
      Unable to handle kernel NULL pointer dereference at virtual address
    00000000
      ...
      CPU: 10 PID: 1 Comm: swapper/0 Not tainted 4.4.240 #197
      task: ffffeb398a45ef10 task.stack: ffffeb398a470000
      PC is at __list_del_entry_valid+0x5c/0xb0
      LR is at pci_slot_release+0x84/0xe4
      ...
      __list_del_entry_valid+0x5c/0xb0
      pci_slot_release+0x84/0xe4
      kobject_put+0x184/0x1c4
      pci_create_slot+0x17c/0x1b4
      __pci_hp_initialize+0x68/0xa4
      pciehp_probe+0x1a4/0x2fc
      pcie_port_probe_service+0x58/0x84
      driver_probe_device+0x320/0x470
    
    Initialize slot->list before calling kobject_init_and_add() to avoid this.
    
    Fixes: 8a94644b ("PCI: Fix pci_create_slot() reference count leak")
    Link: https://lore.kernel.org/r/1606876422-117457-1-git-send-email-zhongjubin@huawei.comSigned-off-by: default avatarJubin Zhong <zhongjubin@huawei.com>
    Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
    Cc: stable@vger.kernel.org	# v5.9+
    4684709b
slot.c 9.67 KB