Re: [PATCH v4 1/6] cxl/test: Add test for module parameters

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The module unregisters `hmem_test_device` without flushing or canceling its pending work, leading to a use-after-free and execute-after-free when the `cxl_test` module unloads.
--

commit 25e58b40eb66000f930689ce58f1f38f11a8a5bd
Author: Dave Jiang <dave.jiang@intel.com>

cxl/test: Add test for module parameters

Add a test for module parameters during module init to make sure that
only one is activated.

[ ... ]

> diff --git a/tools/testing/cxl/test/hmem_test.c b/tools/testing/cxl/test/hmem_test.c
> index 3a1a089e1721b..0fa00f7e16db5 100644
> --- a/tools/testing/cxl/test/hmem_test.c
> +++ b/tools/testing/cxl/test/hmem_test.c
> @@ -3,8 +3,9 @@
>  #include <linux/moduleparam.h>
>  #include <linux/workqueue.h>
>  #include "../../../drivers/dax/bus.h"
> +#include "mock.h"
>  
> -static bool hmem_test;
> +bool hmem_test;
>  
>  static void hmem_test_work(struct work_struct *work)
>  {

[Severity: High]
This is a pre-existing issue, but does the hmem_test module leak
outstanding workqueue references upon unload?

The module unregisters hmem_test_device in hmem_test_exit() without flushing
or canceling its pending work:

tools/testing/cxl/test/hmem_test.c:hmem_test_exit() {
	if (hmem_test)
		platform_device_unregister(&hmem_test_device.pdev);
}

Because hmem_test_device is statically allocated in the module:

tools/testing/cxl/test/hmem_test.c:
	static struct hmem_platform_device hmem_test_device = { ... };

and its release function is in the module's text section:

tools/testing/cxl/test/hmem_test.c:hmem_test_release() {
	struct hmem_platform_device *hpdev =
		container_of(dev, typeof(*hpdev), pdev.dev);

	memset(hpdev, 0, sizeof(*hpdev));
}

could the module unload, allowing its memory to be freed before the
workqueue executes?

If the pending work executes after the module is unloaded, it would access the
freed hmem_test_device memory and trigger hmem_test_release() from the unloaded
text section, causing a kernel crash. Should there be a call to cancel the
work before unregistering the device?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611152124.3656434-1-dave.jiang@intel.com?part=1