Re: [PATCH] powerpc/pseries: Fix use after free in remove_phb_dynamic()

2022-03-20 Thread Michael Ellerman
On Fri, 18 Mar 2022 14:42:19 +1100, Michael Ellerman wrote: > In remove_phb_dynamic() we use &phb->io_resource, after we've called > device_unregister(&host_bridge->dev). But the unregister may have freed > phb, because pcibios_free_controller_deferred() is the release function > for the host_bridg

Re: [PATCH] powerpc/pseries: Fix use after free in remove_phb_dynamic()

2022-03-20 Thread Michael Ellerman
Sachin Sant writes: >> On 18-Mar-2022, at 9:12 AM, Michael Ellerman wrote: >> To avoid it, we can take a reference to the host_bridge->dev until we're >> done using phb. Then when we drop the reference the phb will be freed. >> >> Fixes: 2dd9c11b9d4d ("powerpc/pseries: use pci_host_bridge.releas

Re: [PATCH] powerpc/pseries: Fix use after free in remove_phb_dynamic()

2022-03-20 Thread Sachin Sant
> On 18-Mar-2022, at 9:12 AM, Michael Ellerman wrote: > To avoid it, we can take a reference to the host_bridge->dev until we're > done using phb. Then when we drop the reference the phb will be freed. > > Fixes: 2dd9c11b9d4d ("powerpc/pseries: use pci_host_bridge.release_fn() to > kfree(phb)"

[PATCH] powerpc/pseries: Fix use after free in remove_phb_dynamic()

2022-03-17 Thread Michael Ellerman
In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, because pcibios_free_controller_deferred() is the release function for the host_bridge. If there are no outstanding references when we call device_unreg