Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f466f753 authored by Asias He's avatar Asias He Committed by Rusty Russell
Browse files

virtio-scsi: Fix hotcpu_notifier use-after-free with virtscsi_freeze 



vqs are freed in virtscsi_freeze but the hotcpu_notifier is not
unregistered. We will have a use-after-free usage when the notifier
callback is called after virtscsi_freeze.

Fixes: 285e71ea
("virtio-scsi: reset virtqueue affinity when doing cpu hotplug")

Cc: stable@vger.kernel.org
Signed-off-by: default avatarAsias He <asias.hejun@gmail.com>
Reviewed-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
parent 7d2dddda

drivers/scsi/virtio_scsi.c

+14 −1
Original line number Diff line number Diff line
@@ -956,6 +956,10 @@ static void virtscsi_remove(struct virtio_device *vdev) 
#ifdef CONFIG_PM_SLEEP

static int virtscsi_freeze(struct virtio_device *vdev)

{

	struct Scsi_Host *sh = virtio_scsi_host(vdev);

	struct virtio_scsi *vscsi = shost_priv(sh);



	unregister_hotcpu_notifier(&vscsi->nb);

	virtscsi_remove_vqs(vdev);

	return 0;

}
@@ -964,8 +968,17 @@ static int virtscsi_restore(struct virtio_device *vdev) 
{

	struct Scsi_Host *sh = virtio_scsi_host(vdev);

	struct virtio_scsi *vscsi = shost_priv(sh);

	int err;



	err = virtscsi_init(vdev, vscsi);

	if (err)

		return err;



	return virtscsi_init(vdev, vscsi);

	err = register_hotcpu_notifier(&vscsi->nb);

	if (err)

		vdev->config->del_vqs(vdev);



	return err;

}

#endif