Commit bd91b56c authored by Thomas Tai's avatar Thomas Tai Committed by Bjorn Helgaas

PCI/AER: Work around use-after-free in pcie_do_fatal_recovery()

When an fatal error is received by a non-bridge device, the device is
removed, and pci_stop_and_remove_bus_device() deallocates the device
structure.  The freed device structure is used by subsequent code to send
uevents and print messages.

Hold a reference on the device until we're finished using it.  This is not
an ideal fix because pcie_do_fatal_recovery() should not use the device at
all after removing it, but that's too big a project for right now.

Fixes: 7e9084b3 ("PCI/AER: Handle ERR_FATAL with removal and re-enumeration of devices")
Signed-off-by: default avatarThomas Tai <thomas.tai@oracle.com>
[bhelgaas: changelog, reduce get/put coverage]
Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
parent 270ed733
...@@ -295,6 +295,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service) ...@@ -295,6 +295,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service)
parent = udev->subordinate; parent = udev->subordinate;
pci_lock_rescan_remove(); pci_lock_rescan_remove();
pci_dev_get(dev);
list_for_each_entry_safe_reverse(pdev, temp, &parent->devices, list_for_each_entry_safe_reverse(pdev, temp, &parent->devices,
bus_list) { bus_list) {
pci_dev_get(pdev); pci_dev_get(pdev);
...@@ -328,6 +329,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service) ...@@ -328,6 +329,7 @@ void pcie_do_fatal_recovery(struct pci_dev *dev, u32 service)
pci_info(dev, "Device recovery from fatal error failed\n"); pci_info(dev, "Device recovery from fatal error failed\n");
} }
pci_dev_put(dev);
pci_unlock_rescan_remove(); pci_unlock_rescan_remove();
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment