PCI: Fix pci_slot_release() NULL pointer dereference
authorJubin Zhong <zhongjubin@huawei.com>
Wed, 2 Dec 2020 02:33:42 +0000 (10:33 +0800)
committerBjorn Helgaas <bhelgaas@google.com>
Fri, 4 Dec 2020 23:38:27 +0000 (17:38 -0600)
commit4684709bf81a2d98152ed6b610e3d5c403f9bced
tree6331f788ee519abcc2614ca4e34700d2c64175c4
parente47756c6b4223d045706c5c7fea82c430da30cd2
PCI: Fix pci_slot_release() NULL pointer dereference

If kobject_init_and_add() fails, pci_slot_release() is called to delete
slot->list from parent->slots.  But slot->list hasn't been initialized
yet, so we dereference a NULL pointer:

  Unable to handle kernel NULL pointer dereference at virtual address
00000000
  ...
  CPU: 10 PID: 1 Comm: swapper/0 Not tainted 4.4.240 #197
  task: ffffeb398a45ef10 task.stack: ffffeb398a470000
  PC is at __list_del_entry_valid+0x5c/0xb0
  LR is at pci_slot_release+0x84/0xe4
  ...
  __list_del_entry_valid+0x5c/0xb0
  pci_slot_release+0x84/0xe4
  kobject_put+0x184/0x1c4
  pci_create_slot+0x17c/0x1b4
  __pci_hp_initialize+0x68/0xa4
  pciehp_probe+0x1a4/0x2fc
  pcie_port_probe_service+0x58/0x84
  driver_probe_device+0x320/0x470

Initialize slot->list before calling kobject_init_and_add() to avoid this.

Fixes: 8a94644b440e ("PCI: Fix pci_create_slot() reference count leak")
Link: https://lore.kernel.org/r/1606876422-117457-1-git-send-email-zhongjubin@huawei.com
Signed-off-by: Jubin Zhong <zhongjubin@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v5.9+
drivers/pci/slot.c