* [PATCH] dmaengine: idxd: Fix use-after-free of idxd_wq
@ 2026-04-14 12:45 Guixin Liu
2026-04-14 13:14 ` Guixin Liu
0 siblings, 1 reply; 2+ messages in thread
From: Guixin Liu @ 2026-04-14 12:45 UTC (permalink / raw)
To: Vinicius Costa Gomes, Dave Jiang, Vinod Koul, Frank Li
Cc: dmaengine, Xunlei Pang, oliver.yang
We found an idxd_wq use-after-free issue with kasan:
Use location:
BUG: KASAN: slab-use-after-free in idxd_device_drv_remove+0x1f8/0x240 [idxd]
Call Trace:
<TASK>
dump_stack_lvl+0x32/0x50
print_address_description.constprop.0+0x2c/0x390
? idxd_device_drv_remove+0x1f8/0x240 [idxd]
print_report+0xba/0x280
? kasan_addr_to_slab+0x9/0xa0
? idxd_device_drv_remove+0x1f8/0x240 [idxd]
kasan_report+0xab/0xe0
? idxd_device_drv_remove+0x1f8/0x240 [idxd]
idxd_device_drv_remove+0x1f8/0x240 [idxd]
device_release_driver_internal+0x391/0x560
bus_remove_device+0x1f5/0x3f0
device_del+0x392/0x990
? __pfx_device_del+0x10/0x10
? kobject_cleanup+0x117/0x360
? idxd_unregister_devices+0x229/0x320 [idxd]
device_unregister+0x13/0xa0
idxd_remove+0x4f/0x1b0 [idxd]
pci_device_remove+0xa7/0x1d0
device_release_driver_internal+0x391/0x560
? pci_pme_active+0x1e/0x450
pci_stop_bus_device+0x10a/0x150
pci_stop_and_remove_bus_device_locked+0x16/0x30
remove_store+0xcf/0xe0
Freed by task 15535:
kasan_save_stack+0x1c/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x27/0x40
____kasan_slab_free+0x171/0x240
slab_free_freelist_hook+0xde/0x190
__kmem_cache_free+0x19e/0x310
device_release+0x98/0x210
kobject_cleanup+0x102/0x360
idxd_unregister_devices+0xb3/0x320 [idxd]
dxd_remove+0x3f/0x1b0 [idxd]
pci_device_remove+0xa7/0x1d0
device_release_driver_internal+0x391/0x560
pci_stop_bus_device+0x10a/0x150
pci_stop_and_remove_bus_device_locked+0x16/0x30
remove_store+0xcf/0xe0
In the idxd_remove() flow, when execution reaches
idxd_unregister_devices(), all idxd_wq instances have already been
freed. Subsequently, when device_unregister(idxd_confdev(idxd)) is
executed, it calls into idxd_device_drv_remove() which accesses the
already-freed idxd_wq. This fix resolves the issue by swapping the order
of these two operations.
Fixes: 98da0106aac0d ("dmanegine: idxd: fix resource free ordering on driver removal")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
drivers/dma/idxd/init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
index f1cfc7790d95..4f001ef6b1ef 100644
--- a/drivers/dma/idxd/init.c
+++ b/drivers/dma/idxd/init.c
@@ -1293,7 +1293,6 @@ static void idxd_remove(struct pci_dev *pdev)
{
struct idxd_device *idxd = pci_get_drvdata(pdev);
- idxd_unregister_devices(idxd);
/*
* When ->release() is called for the idxd->conf_dev, it frees all the memory related
* to the idxd context. The driver still needs those bits in order to do the rest of
@@ -1303,6 +1302,7 @@ static void idxd_remove(struct pci_dev *pdev)
*/
get_device(idxd_confdev(idxd));
device_unregister(idxd_confdev(idxd));
+ idxd_unregister_devices(idxd);
idxd_shutdown(pdev);
idxd_device_remove_debugfs(idxd);
perfmon_pmu_remove(idxd);
--
2.32.0.3.g01195cf9f
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] dmaengine: idxd: Fix use-after-free of idxd_wq
2026-04-14 12:45 [PATCH] dmaengine: idxd: Fix use-after-free of idxd_wq Guixin Liu
@ 2026-04-14 13:14 ` Guixin Liu
0 siblings, 0 replies; 2+ messages in thread
From: Guixin Liu @ 2026-04-14 13:14 UTC (permalink / raw)
To: Vinicius Costa Gomes, Dave Jiang, Vinod Koul, Frank Li
Cc: dmaengine, Xunlei Pang, oliver.yang
Well, I found that after this change, there is
another warning call trace:
sysfs group 'power' not found for kobject 'wq6.0'
WARNING: CPU: 74 PID: 15364 at fs/sysfs/group.c:282
sysfs_remove_group+0xfb/0x150
[ 185.957323] Call Trace:
[ 185.957325] <TASK>
[ 185.957327] device_del+0x1f4/0x990
[ 185.957335] ? __pfx_device_del+0x10/0x10
[ 185.957338] ? device_del+0x69a/0x990
[ 185.957341] ? rwsem_wake.isra.0+0xcb/0x120
[ 185.957348] device_unregister+0x13/0xa0
[ 185.957351] idxd_unregister_devices+0xb3/0x320 [idxd]
[ 185.957373] idxd_remove+0x4f/0x1b0 [idxd]
[ 185.957383] pci_device_remove+0xa7/0x1d0
[ 185.957390] device_release_driver_internal+0x391/0x560
[ 185.957395] ? pci_pme_active+0x1e/0x450
[ 185.957399] pci_stop_bus_device+0x10a/0x150
[ 185.957405] pci_stop_and_remove_bus_device_locked+0x16/0x30
...
Please ignore this patch...
Best Regards,
Guixin Liu
在 2026/4/14 20:45, Guixin Liu 写道:
> We found an idxd_wq use-after-free issue with kasan:
> Use location:
> BUG: KASAN: slab-use-after-free in idxd_device_drv_remove+0x1f8/0x240 [idxd]
> Call Trace:
> <TASK>
> dump_stack_lvl+0x32/0x50
> print_address_description.constprop.0+0x2c/0x390
> ? idxd_device_drv_remove+0x1f8/0x240 [idxd]
> print_report+0xba/0x280
> ? kasan_addr_to_slab+0x9/0xa0
> ? idxd_device_drv_remove+0x1f8/0x240 [idxd]
> kasan_report+0xab/0xe0
> ? idxd_device_drv_remove+0x1f8/0x240 [idxd]
> idxd_device_drv_remove+0x1f8/0x240 [idxd]
> device_release_driver_internal+0x391/0x560
> bus_remove_device+0x1f5/0x3f0
> device_del+0x392/0x990
> ? __pfx_device_del+0x10/0x10
> ? kobject_cleanup+0x117/0x360
> ? idxd_unregister_devices+0x229/0x320 [idxd]
> device_unregister+0x13/0xa0
> idxd_remove+0x4f/0x1b0 [idxd]
> pci_device_remove+0xa7/0x1d0
> device_release_driver_internal+0x391/0x560
> ? pci_pme_active+0x1e/0x450
> pci_stop_bus_device+0x10a/0x150
> pci_stop_and_remove_bus_device_locked+0x16/0x30
> remove_store+0xcf/0xe0
>
> Freed by task 15535:
> kasan_save_stack+0x1c/0x40
> kasan_set_track+0x21/0x30
> kasan_save_free_info+0x27/0x40
> ____kasan_slab_free+0x171/0x240
> slab_free_freelist_hook+0xde/0x190
> __kmem_cache_free+0x19e/0x310
> device_release+0x98/0x210
> kobject_cleanup+0x102/0x360
> idxd_unregister_devices+0xb3/0x320 [idxd]
> dxd_remove+0x3f/0x1b0 [idxd]
> pci_device_remove+0xa7/0x1d0
> device_release_driver_internal+0x391/0x560
> pci_stop_bus_device+0x10a/0x150
> pci_stop_and_remove_bus_device_locked+0x16/0x30
> remove_store+0xcf/0xe0
>
> In the idxd_remove() flow, when execution reaches
> idxd_unregister_devices(), all idxd_wq instances have already been
> freed. Subsequently, when device_unregister(idxd_confdev(idxd)) is
> executed, it calls into idxd_device_drv_remove() which accesses the
> already-freed idxd_wq. This fix resolves the issue by swapping the order
> of these two operations.
>
> Fixes: 98da0106aac0d ("dmanegine: idxd: fix resource free ordering on driver removal")
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
> ---
> drivers/dma/idxd/init.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
> index f1cfc7790d95..4f001ef6b1ef 100644
> --- a/drivers/dma/idxd/init.c
> +++ b/drivers/dma/idxd/init.c
> @@ -1293,7 +1293,6 @@ static void idxd_remove(struct pci_dev *pdev)
> {
> struct idxd_device *idxd = pci_get_drvdata(pdev);
>
> - idxd_unregister_devices(idxd);
> /*
> * When ->release() is called for the idxd->conf_dev, it frees all the memory related
> * to the idxd context. The driver still needs those bits in order to do the rest of
> @@ -1303,6 +1302,7 @@ static void idxd_remove(struct pci_dev *pdev)
> */
> get_device(idxd_confdev(idxd));
> device_unregister(idxd_confdev(idxd));
> + idxd_unregister_devices(idxd);
> idxd_shutdown(pdev);
> idxd_device_remove_debugfs(idxd);
> perfmon_pmu_remove(idxd);
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-04-14 13:14 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-14 12:45 [PATCH] dmaengine: idxd: Fix use-after-free of idxd_wq Guixin Liu
2026-04-14 13:14 ` Guixin Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox