| From 9e2be6049cb53b7458eeae03cd562da748f6246b Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 6 Apr 2021 16:40:25 -0300 |
| Subject: vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer |
| |
| From: Jason Gunthorpe <jgg@nvidia.com> |
| |
| [ Upstream commit b5a1f8921d5040bb788492bf33a66758021e4be5 ] |
| |
| There is a small race where the parent is NULL even though the kobj has |
| already been made visible in sysfs. |
| |
| For instance the attribute_group is made visible in sysfs_create_files() |
| and the mdev_type_attr_show() does: |
| |
| ret = attr->show(kobj, type->parent->dev, buf); |
| |
| Which will crash on NULL parent. Move the parent setup to before the type |
| pointer leaves the stack frame. |
| |
| Fixes: 7b96953bc640 ("vfio: Mediated device Core driver") |
| Reviewed-by: Christoph Hellwig <hch@lst.de> |
| Reviewed-by: Kevin Tian <kevin.tian@intel.com> |
| Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com> |
| Reviewed-by: Cornelia Huck <cohuck@redhat.com> |
| Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> |
| Message-Id: <2-v2-d36939638fc6+d54-vfio2_jgg@nvidia.com> |
| Signed-off-by: Alex Williamson <alex.williamson@redhat.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/vfio/mdev/mdev_sysfs.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c |
| index 917fd84c1c6f..367ff5412a38 100644 |
| --- a/drivers/vfio/mdev/mdev_sysfs.c |
| +++ b/drivers/vfio/mdev/mdev_sysfs.c |
| @@ -105,6 +105,7 @@ static struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent, |
| return ERR_PTR(-ENOMEM); |
| |
| type->kobj.kset = parent->mdev_types_kset; |
| + type->parent = parent; |
| |
| ret = kobject_init_and_add(&type->kobj, &mdev_type_ktype, NULL, |
| "%s-%s", dev_driver_string(parent->dev), |
| @@ -132,7 +133,6 @@ static struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent, |
| } |
| |
| type->group = group; |
| - type->parent = parent; |
| return type; |
| |
| attrs_failed: |
| -- |
| 2.30.2 |
| |