mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 07:16:21 +09:00
be23b04074
commit 4684709bf81a2d98152ed6b610e3d5c403f9bced upstream. If kobject_init_and_add() fails, pci_slot_release() is called to delete slot->list from parent->slots. But slot->list hasn't been initialized yet, so we dereference a NULL pointer: Unable to handle kernel NULL pointer dereference at virtual address 00000000 ... CPU: 10 PID: 1 Comm: swapper/0 Not tainted 4.4.240 #197 task: ffffeb398a45ef10 task.stack: ffffeb398a470000 PC is at __list_del_entry_valid+0x5c/0xb0 LR is at pci_slot_release+0x84/0xe4 ... __list_del_entry_valid+0x5c/0xb0 pci_slot_release+0x84/0xe4 kobject_put+0x184/0x1c4 pci_create_slot+0x17c/0x1b4 __pci_hp_initialize+0x68/0xa4 pciehp_probe+0x1a4/0x2fc pcie_port_probe_service+0x58/0x84 driver_probe_device+0x320/0x470 Initialize slot->list before calling kobject_init_and_add() to avoid this. Fixes: 8a94644b440e ("PCI: Fix pci_create_slot() reference count leak") Link: https://lore.kernel.org/r/1606876422-117457-1-git-send-email-zhongjubin@huawei.com Signed-off-by: Jubin Zhong <zhongjubin@huawei.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: stable@vger.kernel.org # v5.9+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
controller | ||
endpoint | ||
hotplug | ||
pcie | ||
switch | ||
access.c | ||
ats.c | ||
bus.c | ||
ecam.c | ||
host-bridge.c | ||
iov.c | ||
irq.c | ||
Kconfig | ||
Makefile | ||
mmap.c | ||
msi.c | ||
of.c | ||
p2pdma.c | ||
pci-acpi.c | ||
pci-bridge-emul.c | ||
pci-bridge-emul.h | ||
pci-driver.c | ||
pci-label.c | ||
pci-mid.c | ||
pci-pf-stub.c | ||
pci-stub.c | ||
pci-sysfs.c | ||
pci.c | ||
pci.h | ||
probe.c | ||
proc.c | ||
quirks.c | ||
remove.c | ||
rom.c | ||
search.c | ||
setup-bus.c | ||
setup-irq.c | ||
setup-res.c | ||
slot.c | ||
syscall.c | ||
vc.c | ||
vpd.c | ||
xen-pcifront.c |