Re: [PATCH v4] cxl/core: Fix dport use-after-free via the einj_inject debugfs file

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Ignoring the return value of devm_add_action_or_reset() leads to a use-after-free of the debugfs directory dentry on the error path.
--

commit acaad538920d3905d33312c0501a79695900337c
Author: Guixin Liu <kanie@linux.alibaba.com>

cxl/core: Fix dport use-after-free via the einj_inject debugfs file

This commit fixes a use-after-free when accessing the per-dport einj_inject
debugfs file after unbinding the dport host. It registers a devm action to
remove the debugfs directory when the dport host is released.

> diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
> index 625e4aa427db0..82513b46f6347 100644
> --- a/drivers/cxl/core/port.c
> +++ b/drivers/cxl/core/port.c
[ ... ]
> @@ -832,6 +837,8 @@ static void cxl_debugfs_create_dport_dir(struct cxl_dport *dport)
>  
>  	dir = cxl_debugfs_create_dir(dev_name(dport->dport_dev));
>  
> +	devm_add_action_or_reset(dport_to_host(dport), remove_debugfs, dir);
> +

[Severity: High]
If devm_add_action_or_reset() fails, will this lead to a use-after-free of
the dir dentry?

When devm_add_action_or_reset() fails to allocate memory for the devres
node, it immediately executes the registered action before returning an
error. In this case, remove_debugfs() would be called, which runs
debugfs_remove_recursive(dir) and drops the reference to the dentry,
potentially freeing it.

Since cxl_debugfs_create_dport_dir() ignores the return value of
devm_add_action_or_reset(), it proceeds to call debugfs_create_file(),
passing the freed dir pointer as the parent directory.

Should this check the return value and return early if the devm action
fails to register?

>  	debugfs_create_file("einj_inject", 0200, dir, dport,
>  			    &cxl_einj_inject_fops);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914121843.718493-1-kanie@linux.alibaba.com?part=1