On Sun, Mar 12, 2023 at 4:41 PM Eli Cohen <elic@xxxxxxxxxx> wrote:
>
> When deleting the vdpa device, the debugfs files need to be removed so
> need to remove debugfs after the device has been unregistered.
>
> This fixes null pointer dereference when someone deletes the device
> after debugfs has been populated.
>
> Fixes: 294221004322 ("vdpa/mlx5: Add debugfs subtree")
> Signed-off-by: Eli Cohen <elic@xxxxxxxxxx>
> ---
> drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
> index 3858ba1e8975..3f6149f2ffd4 100644
> --- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
> +++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
> @@ -3322,8 +3322,6 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device *
> struct mlx5_vdpa_net *ndev = to_mlx5_vdpa_ndev(mvdev);
> struct workqueue_struct *wq;
>
> - mlx5_vdpa_remove_debugfs(ndev->debugfs);
> - ndev->debugfs = NULL;
> if (ndev->nb_registered) {
> ndev->nb_registered = false;
> mlx5_notifier_unregister(mvdev->mdev, &ndev->nb);
> @@ -3332,6 +3330,8 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device *
> mvdev->wq = NULL;
> destroy_workqueue(wq);
> _vdpa_unregister_device(dev);
What if the user tries to access debugfs after _vdpa_unregister_device()?
Thanks
> + mlx5_vdpa_remove_debugfs(ndev->debugfs);
> + ndev->debugfs = NULL;
> mgtdev->ndev = NULL;
> }
>
> --
> 2.38.1
>
_______________________________________________
Virtualization mailing list
Virtualization@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
