Re: [PATCH] misc: pci_endpoint_test: fix use-after-free after device unbind

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Deadlock in pci_endpoint_test_remove() on device unbind due to serialization with ioctls that sleep indefinitely.
--

commit 8935a4226276767a2564aa469158f4ffb5341492
Author: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

misc: pci_endpoint_test: fix use-after-free after device unbind

This commit explicitly manages the lifetime of the test object with a kref
to prevent a use-after-free when an open file descriptor outlives the PCI
device binding. The remove path now serializes with ioctl using the
existing mutex and clears device state before dropping the initial
reference.

Closes: https://lore.kernel.org/all/178144969601.60470.7358419009914000395@gmail.com/

> diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
> index dbd017cabbb92..981a834ce41bd 100644
> --- a/drivers/misc/pci_endpoint_test.c
> +++ b/drivers/misc/pci_endpoint_test.c
[ ... ]
> @@ -1364,10 +1405,13 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev)
>  	if (id < 0)
>  		return;
>  
> +	misc_deregister(&test->miscdev);
> +
> +	mutex_lock(&test->mutex);
> +

[Severity: High]
Can this lock acquisition cause a deadlock during device unbind?

The ioctl handlers, such as pci_endpoint_test_copy(), hold this same mutex
while waiting indefinitely for hardware interrupts:

    mutex_lock(&test->mutex);
    ...
    wait_for_completion(&test->irq_raised);

If the hardware fails to raise the expected interrupt, perhaps due to a
hardware hang or abrupt hot-unplug, the ioctl thread will block forever
while holding the mutex.

Since pci_endpoint_test_remove() now waits on this mutex, wouldn't a hanging
ioctl permanently block the removal path and deadlock the PCI subsystem for
this device?

>  	pci_endpoint_test_release_irq(test);
>  	pci_endpoint_test_free_irq_vectors(test);
>  
> -	misc_deregister(&test->miscdev);
>  	kfree(misc_device->name);
>  	kfree(test->name);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260621054609.186877-1-shuangpeng.kernel@gmail.com?part=1