[BUG] vdpa: use-after-free and WARN in _vdpa_unregister_device()

Farhad Alemi <[email protected]>
Newsgroups dev.linux.lists.virtualization,org.kernel.vger.linux-kernel
Message-ID <CA+0ovCj_MtGXFvyQwFiaLN0uqO9WprxXkAwhiqKA=JzBp40K=Q@mail.gmail.com>
Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/163-warning-in-vdpa-unregister-device/

  BUG: KASAN: slab-use-after-free in _vdpa_unregister_device+0x35/0x60
drivers/vdpa/vdpa.c:250
  Read of size 8 at addr ffff88810eeef350 by task syz.1.2/11300
  Call Trace:
   _vdpa_unregister_device+0x35/0x60 drivers/vdpa/vdpa.c:250
   vp_vdpa_dev_del+0x3d/0x60 drivers/vdpa/virtio_pci/vp_vdpa.c:593
   vdpa_match_remove+0x97/0xb0 drivers/vdpa/vdpa.c:321
   bus_for_each_dev+0x23a/0x2c0 drivers/base/bus.c:383
   vdpa_mgmtdev_unregister+0x110/0x130 drivers/vdpa/vdpa.c:332
   vp_vdpa_remove+0x5e/0xa0 drivers/vdpa/virtio_pci/vp_vdpa.c:683
   pci_device_remove+0xa3/0x250 drivers/pci/pci-driver.c:512
   device_release_driver_internal+0x464/0x860 drivers/base/dd.c:1375

  WARNING: drivers/vdpa/vdpa.c:250 at
_vdpa_unregister_device+0x51/0x60 drivers/vdpa/vdpa.c:250, CPU#0:
syz.8.826/22808

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.