From: Bjorn Helgaas <helgaas@kernel.org>
To: Ziming Du <duziming2@huawei.com>
Cc: bhelgaas@google.com, jbarnes@virtuousgeek.org, chrisw@redhat.com,
alex.williamson@redhat.com, linux-pci@vger.kernel.org,
linux-kernel@vger.kernel.org, liuyongqiang13@huawei.com
Subject: Re: [PATCH v2 1/3] PCI/sysfs: Fix null pointer dereference during hotplug
Date: Mon, 29 Dec 2025 11:31:06 -0600 [thread overview]
Message-ID: <20251229173106.GA69373@bhelgaas> (raw)
In-Reply-To: <20251224092721.2034529-2-duziming2@huawei.com>
On Wed, Dec 24, 2025 at 05:27:17PM +0800, Ziming Du wrote:
> During the concurrent process of creating and rescanning in VF, the
> resource files for the same pci_dev may be created twice. The second
> creation attempt fails, resulting the res_attr in pci_dev to kfree(),
> but the pointer is not set to NULL. This will subsequently lead to
> dereferencing a null pointer when removing the device.
>
> When we perform the following operation:
> echo $vfcount > /sys/class/net/"$pfname"/device/sriov_numvfs &
Is the value of $vfcount relevant here? Can you use the actual values
here instead of the variables so this is more useful to others?
> sleep 0.5
> echo 1 > /sys/bus/pci/rescan
> pci_remove "$pfname"
> system will crash as follows:
next prev parent reply other threads:[~2025-12-29 17:31 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-24 9:27 [PATCH v2 0/3] Miscellaneous fixes for pci subsystem Ziming Du
2025-12-24 9:27 ` [PATCH v2 1/3] PCI/sysfs: Fix null pointer dereference during hotplug Ziming Du
2025-12-29 17:31 ` Bjorn Helgaas [this message]
2025-12-30 3:40 ` duziming
2025-12-24 9:27 ` [PATCH v2 2/3] PCI: Prevent overflow in proc_bus_pci_write() Ziming Du
2025-12-29 18:07 ` Bjorn Helgaas
2025-12-30 8:20 ` duziming
2025-12-31 9:31 ` Ilpo Järvinen
2025-12-31 17:04 ` Bjorn Helgaas
2026-01-04 7:17 ` duziming
2025-12-24 9:27 ` [PATCH v2 3/3] PCI/sysfs: Prohibit unaligned access to I/O port on non-x86 Ziming Du
2025-12-29 9:36 ` Ilpo Järvinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251229173106.GA69373@bhelgaas \
--to=helgaas@kernel.org \
--cc=alex.williamson@redhat.com \
--cc=bhelgaas@google.com \
--cc=chrisw@redhat.com \
--cc=duziming2@huawei.com \
--cc=jbarnes@virtuousgeek.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=liuyongqiang13@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.