[PATCH] powerpc/pseries: Fix use after free in remove_phb_dynamic()

Michael Ellerman patch-notifications at ellerman.id.au
Mon Mar 21 16:05:55 AEDT 2022


On Fri, 18 Mar 2022 14:42:19 +1100, Michael Ellerman wrote:
> In remove_phb_dynamic() we use &phb->io_resource, after we've called
> device_unregister(&host_bridge->dev). But the unregister may have freed
> phb, because pcibios_free_controller_deferred() is the release function
> for the host_bridge.
> 
> If there are no outstanding references when we call device_unregister()
> then phb will be freed out from under us.
> 
> [...]

Applied to powerpc/next.

[1/1] powerpc/pseries: Fix use after free in remove_phb_dynamic()
      https://git.kernel.org/powerpc/c/fe2640bd7a62f1f7c3f55fbda31084085075bc30

cheers


More information about the Linuxppc-dev mailing list