[BUG] vdpa: use-after-free and WARN in _vdpa_unregister_device()
Farhad Alemi <[email protected]>
| Newsgroups | dev.linux.lists.virtualization,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <CA+0ovCj_MtGXFvyQwFiaLN0uqO9WprxXkAwhiqKA=JzBp40K=Q@mail.gmail.com> |
Hello, As part of the kernel research at ASU's SEFCOM lab, we hit the crash below. Crash reports can be found here: https://github.com/farhad-alemi/public_bug_reports/tree/main/163-warning-in-vdpa-unregister-device/ BUG: KASAN: slab-use-after-free in _vdpa_unregister_device+0x35/0x60 drivers/vdpa/vdpa.c:250 Read of size 8 at addr ffff88810eeef350 by task syz.1.2/11300 Call Trace: _vdpa_unregister_device+0x35/0x60 drivers/vdpa/vdpa.c:250 vp_vdpa_dev_del+0x3d/0x60 drivers/vdpa/virtio_pci/vp_vdpa.c:593 vdpa_match_remove+0x97/0xb0 drivers/vdpa/vdpa.c:321 bus_for_each_dev+0x23a/0x2c0 drivers/base/bus.c:383 vdpa_mgmtdev_unregister+0x110/0x130 drivers/vdpa/vdpa.c:332 vp_vdpa_remove+0x5e/0xa0 drivers/vdpa/virtio_pci/vp_vdpa.c:683 pci_device_remove+0xa3/0x250 drivers/pci/pci-driver.c:512 device_release_driver_internal+0x464/0x860 drivers/base/dd.c:1375 WARNING: drivers/vdpa/vdpa.c:250 at _vdpa_unregister_device+0x51/0x60 drivers/vdpa/vdpa.c:250, CPU#0: syz.8.826/22808 Our reproducer.c is available upon request. Happy to test a patch if that would help. Regards,