diff options
| author | Thomas Tai <thomas.tai@oracle.com> | 2018-07-26 12:13:04 -0500 |
|---|---|---|
| committer | Bjorn Helgaas <helgaas@kernel.org> | 2018-07-26 12:13:04 -0500 |
| commit | bd91b56cb3b27492963caeb5fccefe20a986ca8d (patch) | |
| tree | 3df6c7e55a6802db5af2b11791b52f120ed2ea5f /kernel/fork.c | |
| parent | 270ed733e68955049b693bea8f4a1efb293a96ae (diff) | |
| download | linux-bd91b56cb3b27492963caeb5fccefe20a986ca8d.tar.bz2 | |
PCI/AER: Work around use-after-free in pcie_do_fatal_recovery()
When an fatal error is received by a non-bridge device, the device is
removed, and pci_stop_and_remove_bus_device() deallocates the device
structure. The freed device structure is used by subsequent code to send
uevents and print messages.
Hold a reference on the device until we're finished using it. This is not
an ideal fix because pcie_do_fatal_recovery() should not use the device at
all after removing it, but that's too big a project for right now.
Fixes: 7e9084b36740 ("PCI/AER: Handle ERR_FATAL with removal and re-enumeration of devices")
Signed-off-by: Thomas Tai <thomas.tai@oracle.com>
[bhelgaas: changelog, reduce get/put coverage]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Diffstat (limited to 'kernel/fork.c')
0 files changed, 0 insertions, 0 deletions