linux/arch/s390
Niklas Schnelle 2a671f77ee s390/pci: fix use after free of zpci_dev
The struct pci_dev uses reference counting but zPCI assumed erroneously
that the last reference would always be the local reference after
calling pci_stop_and_remove_bus_device(). This is usually the case but
not how reference counting works and thus inherently fragile.

In fact one case where this causes a NULL pointer dereference when on an
SRIOV device the function 0 was hot unplugged before another function of
the same multi-function device. In this case the second function's
pdev->sriov->dev reference keeps the struct pci_dev of function 0 alive
even after the unplug. This bug was previously hidden by the fact that
we were leaking the struct pci_dev which in turn means that it always
outlived the struct zpci_dev. This was fixed in commit 0b13525c20
("s390/pci: fix leak of PCI device structure") exposing the broken
behavior.

Fix this by accounting for the long living reference a struct pci_dev
has to its underlying struct zpci_dev via the zbus->function[] array and
only release that in pcibios_release_device() ensuring that the struct
pci_dev is not left with a dangling reference. This is a minimal fix in
the future it would probably better to use fine grained reference
counting for struct zpci_dev.

Fixes: 05bc1be6db ("s390/pci: create zPCI bus")
Cc: stable@vger.kernel.org
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2021-08-18 10:12:42 +02:00
..
appldata s390/appldata: use struct_size() helper 2020-06-29 16:32:34 +02:00
boot s390/boot: fix zstd build for -march=z900 2021-07-30 17:08:22 +02:00
configs s390: update defconfigs 2021-08-03 14:31:24 +02:00
crypto s390/archrandom: add parameter check for s390_arch_random_generate 2021-04-21 12:32:12 +02:00
hypfs s390/hypfs: use register pair instead of register asm 2021-06-28 11:18:28 +02:00
include ARM: 2021-07-29 09:42:09 -07:00
kernel s390/vdso: add .got.plt in vdso linker script 2021-07-30 17:08:21 +02:00
kvm KVM: s390: restore old debugfs names 2021-07-27 16:59:00 -04:00
lib s390/lib: use call_on_stack() macro 2021-07-08 22:12:18 +02:00
mm s390/mm: use call_on_stack() macro 2021-07-08 22:12:18 +02:00
net bpf: Introduce BPF nospec instruction for mitigating Spectre v4 2021-07-29 00:20:56 +02:00
pci s390/pci: fix use after free of zpci_dev 2021-08-18 10:12:42 +02:00
purgatory s390: disable SSP when needed 2021-06-07 17:07:00 +02:00
tools KVM: s390: gen_facilities: allow facilities 165, 193, 194 and 196 2021-06-23 09:35:03 +02:00
Kbuild s390/numa: move code to arch/s390/kernel 2020-08-11 18:16:55 +02:00
Kconfig s390/vdso: add minimal compat vdso 2021-07-08 15:37:28 +02:00
Kconfig.debug s390/cio: add CRW inject functionality 2021-03-22 11:36:04 +01:00
Makefile Kbuild updates for v5.14 2021-07-10 11:01:38 -07:00