concurrently creating attr files may cause uaf. We meet this in concurrently
plug and unplug network card. For example:
echo 20 > /sys/class/net/eth3/device/sriov_numvfs &
echo 1 > /sys/bus/pci/rescan
crash log snips as following:
Call Trace:
<TASK>
? _die_body+0x1a/0xe0
? page_fault_oops+0x81/0x150
? _wake_up_sync_key+0x37/0x50
? exc_page_fault+0x525/0x730
? asm_exc_page_fault+0x22/0x30
? pci_create_attr+0x160/0x180
? pfx_strlen+0x10/0x10
kernfs_name_hash+0x12/0x80
kernfs_find_ns+0x35/0xc0
kernfs_remove_by_name_ns+0x46/0xc0
pci_stop_bus_device+0x7c/0x90
pci_stop_and_remole_bus_device+0xe/0x20
pci_iov_remove_virtfn+0xbd/0x120
sriov_disable+0x34/0xe0
hinic_pci_sriov_diisable+0x35/0xa0 [hinic]
hinic_remove+0x22e/0x2a0 [hinic]
pci_device_remove+0x3b/0xb0
device_release_driver_internal+0x19b/0x200
pci_stop_bus_device+0x6c/0x90
pci_stop_and_remolre_bus_device_locked+0x16/0x30
remove_store+0xfc/0x130
kernfs_fop_write_iter+0x11b/0x200
set resource pointer to zero to fix this problem.
Signed-off-by: zhangjian <zhangjian496@xxxxxxxxxx>
---
drivers/pci/pci-sysfs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 268c69daa..12dba9228 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -1180,12 +1180,14 @@ static void pci_remove_resource_files(struct pci_dev *pdev)
if (res_attr) {
sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
kfree(res_attr);
+ pdev->res_attr[i] = NULL;
}
res_attr = pdev->res_attr_wc[i];
if (res_attr) {
sysfs_remove_bin_file(&pdev->dev.kobj, res_attr);
kfree(res_attr);
+ pdev->res_attr_wc[i] = NULL;
}
}
}
--
2.33.0
