Unverified Commit bb32e208 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14572 PCI: Fix use-after-free of slot->bus on hot remove 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xiongfeng Wang <wangxiongfeng2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/GJSTEVW2WYY255DB5JKSJCJCHS2AMRB7/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBEAF8 
 
Link:https://gitee.com/openeuler/kernel/pulls/14572

 

Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Reviewed-by: default avatarWang ShaoBo <bobo.shaobowang@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents 1239f025 59a8f722

drivers/pci/slot.c

+3 −1
Original line number Diff line number Diff line
@@ -79,6 +79,7 @@ static void pci_slot_release(struct kobject *kobj) 
	up_read(&pci_bus_sem);



	list_del(&slot->list);

	pci_bus_put(slot->bus);



	kfree(slot);

}
@@ -260,7 +261,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, 
		goto err;

	}



	slot->bus = parent;

	slot->bus = pci_bus_get(parent);

	slot->number = slot_nr;



	slot->kobj.kset = pci_slots_kset;
@@ -268,6 +269,7 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr, 
	slot_name = make_slot_name(name);

	if (!slot_name) {

		err = -ENOMEM;

		pci_bus_put(slot->bus);

		kfree(slot);

		goto err;

	}