Re: [PATCH] dmaengine: idxd: Fix use-after-free of idxd_wq

[Guixin Liu <kanie@linux.alibaba.com>]

Well, I found that after this change, there is
another warning call trace:

sysfs group 'power' not found for kobject 'wq6.0'
WARNING: CPU: 74 PID: 15364 at fs/sysfs/group.c:282 
sysfs_remove_group+0xfb/0x150
[  185.957323] Call Trace:
[  185.957325]  <TASK>
[  185.957327]  device_del+0x1f4/0x990
[  185.957335]  ? __pfx_device_del+0x10/0x10
[  185.957338]  ? device_del+0x69a/0x990
[  185.957341]  ? rwsem_wake.isra.0+0xcb/0x120
[  185.957348]  device_unregister+0x13/0xa0
[  185.957351]  idxd_unregister_devices+0xb3/0x320 [idxd]
[  185.957373]  idxd_remove+0x4f/0x1b0 [idxd]
[  185.957383]  pci_device_remove+0xa7/0x1d0
[  185.957390]  device_release_driver_internal+0x391/0x560
[  185.957395]  ? pci_pme_active+0x1e/0x450
[  185.957399]  pci_stop_bus_device+0x10a/0x150
[  185.957405]  pci_stop_and_remove_bus_device_locked+0x16/0x30
...

Please ignore this patch...

Best Regards,
Guixin Liu

在 2026/4/14 20:45, Guixin Liu 写道:
> We found an idxd_wq use-after-free issue with kasan:
> Use location:
> BUG: KASAN: slab-use-after-free in idxd_device_drv_remove+0x1f8/0x240 [idxd]
> Call Trace:
>    <TASK>
>    dump_stack_lvl+0x32/0x50
>    print_address_description.constprop.0+0x2c/0x390
>    ? idxd_device_drv_remove+0x1f8/0x240 [idxd]
>    print_report+0xba/0x280
>    ? kasan_addr_to_slab+0x9/0xa0
>    ? idxd_device_drv_remove+0x1f8/0x240 [idxd]
>    kasan_report+0xab/0xe0
>    ? idxd_device_drv_remove+0x1f8/0x240 [idxd]
>    idxd_device_drv_remove+0x1f8/0x240 [idxd]
>    device_release_driver_internal+0x391/0x560
>    bus_remove_device+0x1f5/0x3f0
>    device_del+0x392/0x990
>    ? __pfx_device_del+0x10/0x10
>    ? kobject_cleanup+0x117/0x360
>    ? idxd_unregister_devices+0x229/0x320 [idxd]
>    device_unregister+0x13/0xa0
>    idxd_remove+0x4f/0x1b0 [idxd]
>    pci_device_remove+0xa7/0x1d0
>    device_release_driver_internal+0x391/0x560
>    ? pci_pme_active+0x1e/0x450
>    pci_stop_bus_device+0x10a/0x150
>    pci_stop_and_remove_bus_device_locked+0x16/0x30
>    remove_store+0xcf/0xe0
>
> Freed by task 15535:
>    kasan_save_stack+0x1c/0x40
>    kasan_set_track+0x21/0x30
>    kasan_save_free_info+0x27/0x40
>    ____kasan_slab_free+0x171/0x240
>    slab_free_freelist_hook+0xde/0x190
>    __kmem_cache_free+0x19e/0x310
>    device_release+0x98/0x210
>    kobject_cleanup+0x102/0x360
>    idxd_unregister_devices+0xb3/0x320 [idxd]
>    dxd_remove+0x3f/0x1b0 [idxd]
>    pci_device_remove+0xa7/0x1d0
>    device_release_driver_internal+0x391/0x560
>    pci_stop_bus_device+0x10a/0x150
>    pci_stop_and_remove_bus_device_locked+0x16/0x30
>    remove_store+0xcf/0xe0
>
> In the idxd_remove() flow, when execution reaches
> idxd_unregister_devices(), all idxd_wq instances have already been
> freed. Subsequently, when device_unregister(idxd_confdev(idxd)) is
> executed, it calls into idxd_device_drv_remove() which accesses the
> already-freed idxd_wq. This fix resolves the issue by swapping the order
> of these two operations.
>
> Fixes: 98da0106aac0d ("dmanegine: idxd: fix resource free ordering on driver removal")
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
> ---
>   drivers/dma/idxd/init.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
> index f1cfc7790d95..4f001ef6b1ef 100644
> --- a/drivers/dma/idxd/init.c
> +++ b/drivers/dma/idxd/init.c
> @@ -1293,7 +1293,6 @@ static void idxd_remove(struct pci_dev *pdev)
>   {
>   	struct idxd_device *idxd = pci_get_drvdata(pdev);
>   
> -	idxd_unregister_devices(idxd);
>   	/*
>   	 * When ->release() is called for the idxd->conf_dev, it frees all the memory related
>   	 * to the idxd context. The driver still needs those bits in order to do the rest of
> @@ -1303,6 +1302,7 @@ static void idxd_remove(struct pci_dev *pdev)
>   	 */
>   	get_device(idxd_confdev(idxd));
>   	device_unregister(idxd_confdev(idxd));
> +	idxd_unregister_devices(idxd);
>   	idxd_shutdown(pdev);
>   	idxd_device_remove_debugfs(idxd);
>   	perfmon_pmu_remove(idxd);