* [PATCH] dmaengine: idxd: Fix use-after-free in idxd_remove
@ 2026-09-11 6:55 Ziyou Wang (Lenovo)
2026-09-11 7:14 ` sashiko-bot
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Ziyou Wang (Lenovo) @ 2026-09-11 6:55 UTC (permalink / raw)
To: Vinod Koul, Vinicius Costa Gomes
Cc: Dave Jiang, Frank Li, dmaengine, linux-kernel,
Ziyou Wang (Lenovo), Adrian Huang
When unbinding the idxd driver, the following call trace is observed:
general protection fault, probably for non-canonical address 0x18fc1d6937256657
CPU: 117 UID: 0 PID: 3396 Comm: python3 Tainted: G E 7.2.0-rc5-latest+ #11 PREEMPT(lazy)
Hardware name: Lenovo WenTian WR5220 G5, BIOS speb50m-2.54
RIP: 0010:__refill_objects_node+0x2da/0x5e0
Call Trace:
<TASK>
refill_objects+0x1ee/0x2e0
__pcs_replace_empty_main+0x1e1/0x330
__kmalloc_noprof+0x503/0x550
ext4_htree_store_dirent+0x34/0x110 [ext4]
htree_dirblock_to_tree+0x1a9/0x2c0 [ext4]
ext4_htree_fill_tree+0x246/0x3d0 [ext4]
ext4_readdir+0x863/0x9d0 [ext4]
iterate_dir+0xa6/0x260
__x64_sys_getdents64+0x76/0x130
do_syscall_64+0x98/0x620
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
With the KASAN-enabled kernel, the kernel reports a use-after-free bug:
idxd_unregister_devices() calls device_unregister(wq), which triggers
the wq release callback and frees wq memory via kfree(). However,
idxd->wqs[] array still holds the freed pointer. Later, when
device_unregister(idxd) calls idxd_device_drv_remove(), it accesses
wq->state through idxd->wqs[], resulting in use-after-free.
The same issue exists for idxd->engines[] and idxd->groups[] arrays.
KASAN report:
BUG: KASAN: slab-use-after-free in idxd_device_drv_remove+0xc1/0x100 [idxd]
Read of size 4 at addr ff1100038d296414 by task python3/3354
CPU: 20 UID: 0 PID: 3354 Comm: python3 Tainted: G E 7.2.0-rc5-debug+
Hardware name: Lenovo WenTian WR5220 G5, BIOS speb50m-2.54
Call Trace:
<TASK>
dump_stack_lvl+0x5b/0x80
print_report+0x153/0x4b5
kasan_report+0xbc/0xf0
idxd_device_drv_remove+0xc1/0x100 [idxd]
device_release_driver_internal+0x244/0x2e0
bus_remove_device+0x195/0x2b0
device_del+0x24b/0x540
device_unregister+0x17/0x80
idxd_remove+0x3f/0x120 [idxd]
pci_device_remove+0x6d/0xf0
device_release_driver_internal+0x244/0x2e0
unbind_store+0xae/0xb0
kernfs_fop_write_iter+0x205/0x2d0
vfs_write+0x3a9/0x6b0
ksys_write+0xc7/0x160
do_syscall_64+0x9c/0x620
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
Allocated by task 1219:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x9a/0xb0
__kmalloc_cache_node_noprof+0x1c6/0x470
idxd_pci_probe_alloc+0x103f/0x2430 [idxd]
local_pci_probe+0x71/0xd0
local_pci_probe_callback+0x20/0x40
process_one_work+0x389/0x6a0
worker_thread+0x321+0x590
kthread+0x1b4/0x200
ret_from_fork+0x3bd/0x4d0
ret_from_fork_asm+0x1a/0x30
Freed by task 3354:
kasan_save_stack+0x20/0x40
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x70
__kasan_slab_free+0x6b/0x90
kfree+0x1d4/0x520
device_release+0x77/0x120
kobject_put+0xdb/0x2a0
idxd_unregister_devices+0x5b/0x130 [idxd]
idxd_remove+0x2f/0x120 [idxd]
pci_device_remove+0x6d/0xf0
device_release_driver_internal+0x244/0x2e0
unbind_store+0xae/0xb0
kernfs_fop_write_iter+0x205/0x2d0
vfs_write+0x3a9/0x6b0
ksys_write+0xc7/0x160
do_syscall_64+0x9c/0x620
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fix by taking refs on wq/engine/group conf_dev in idxd_unregister_devices()
before calling device_unregister(). This prevents their memory from being
freed until after idxd_device_drv_remove() completes. Add idxd_put_devices()
to release the refs after all cleanup activities are done.
To reproduce:
cd dsa-perf-micros
./scripts/setup_dsa.sh -d dsa0 -w 1 -m s -e 4
echo "0000:00:01.0" > /sys/bus/pci/drivers/idxd/unbind
Fixes: 47c16ac27d4c ("dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime")
Suggested-by: Adrian Huang (Lenovo) <adrianhuang0701@gmail.com>
Signed-off-by: Ziyou Wang (Lenovo) <ziyou.dev@gmail.com>
---
Added a Suggested-by tag for Adrian, as he came up with the idea for this patch.
drivers/dma/idxd/init.c | 15 +++++++++++++++
drivers/dma/idxd/sysfs.c | 8 ++++++++
2 files changed, 23 insertions(+)
diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
index 4b827a329756..212efbfebacc 100644
--- a/drivers/dma/idxd/init.c
+++ b/drivers/dma/idxd/init.c
@@ -1263,6 +1263,20 @@ static void idxd_shutdown(struct pci_dev *pdev)
flush_workqueue(idxd->wq);
}
+static void idxd_put_devices(struct idxd_device *idxd)
+{
+ int i;
+
+ for (i = 0; i < idxd->max_wqs; i++)
+ put_device(wq_confdev(idxd->wqs[i]));
+
+ for (i = 0; i < idxd->max_engines; i++)
+ put_device(engine_confdev(idxd->engines[i]));
+
+ for (i = 0; i < idxd->max_groups; i++)
+ put_device(group_confdev(idxd->groups[i]));
+}
+
static void idxd_remove(struct pci_dev *pdev)
{
struct idxd_device *idxd = pci_get_drvdata(pdev);
@@ -1284,6 +1298,7 @@ static void idxd_remove(struct pci_dev *pdev)
if (device_pasid_enabled(idxd))
idxd_disable_system_pasid(idxd);
pci_iounmap(pdev, idxd->reg_base);
+ idxd_put_devices(idxd);
put_device(idxd_confdev(idxd));
pci_disable_device(pdev);
}
diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
index 6d251095c350..eca96a4dcecd 100644
--- a/drivers/dma/idxd/sysfs.c
+++ b/drivers/dma/idxd/sysfs.c
@@ -1988,21 +1988,29 @@ void idxd_unregister_devices(struct idxd_device *idxd)
{
int i;
+ /*
+ * Take a reference count to the idxd device to prevent the
+ * corresponding idxd context from being freed, as the driver
+ * still needs it for the remaining cleanup operations.
+ */
for (i = 0; i < idxd->max_wqs; i++) {
struct idxd_wq *wq = idxd->wqs[i];
+ get_device(wq_confdev(wq));
device_unregister(wq_confdev(wq));
}
for (i = 0; i < idxd->max_engines; i++) {
struct idxd_engine *engine = idxd->engines[i];
+ get_device(engine_confdev(engine));
device_unregister(engine_confdev(engine));
}
for (i = 0; i < idxd->max_groups; i++) {
struct idxd_group *group = idxd->groups[i];
+ get_device(group_confdev(group));
device_unregister(group_confdev(group));
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] dmaengine: idxd: Fix use-after-free in idxd_remove
2026-09-11 6:55 [PATCH] dmaengine: idxd: Fix use-after-free in idxd_remove Ziyou Wang (Lenovo)
@ 2026-09-11 7:14 ` sashiko-bot
2026-10-30 14:54 ` Frank Li
[not found] ` <CABBdrdLtTJL7-xgB4i=AvqBoBJfFzYvJe+gV+KyLz5=QjUWkCg@mail.gmail.com>
2 siblings, 0 replies; 4+ messages in thread
From: sashiko-bot @ 2026-09-11 7:14 UTC (permalink / raw)
To: Ziyou Wang (Lenovo); +Cc: dmaengine, vkoul, Frank.Li
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
Pre-existing issues:
- [High] Pre-existing Use-After-Free and Double Free in the error path of `idxd_register_devices()` and `idxd_pci_probe_alloc()`.
- [High] Pre-existing double free and UAF of the IDXD device and its resources in `idxd_free()`.
- [High] Flawed `while (j--)` loop condition in device registration cleanup paths causes an out-of-bounds array read on the first iteration failure, and skips unregistering elements on subsequent iteration failures.
- [Medium] Pre-existing memory leak of the `saved_engines` array in the error paths of `idxd_device_config_save`.
--
commit cf8581894d15c4c8e08a44d0ae7b7e0a1a4eb54c
Author: Ziyou Wang (Lenovo) <ziyou.dev@gmail.com>
dmaengine: idxd: Fix use-after-free in idxd_remove
This commit fixes a use-after-free bug in the idxd driver unbind path
by taking reference counts on the wq, engine, and group devices before
unregistering them. It adds idxd_put_devices() to release these references
after all cleanup operations are complete.
> diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
> index 4b827a3297564..212efbfebacce 100644
> --- a/drivers/dma/idxd/init.c
> +++ b/drivers/dma/idxd/init.c
[ ... ]
[Severity: Medium]
This is a pre-existing issue, but does idxd_device_config_save() leak the
saved_engines array on error?
Looking at idxd_device_config_save() in drivers/dma/idxd/init.c:
struct idxd_engine **saved_engines =
kcalloc_node(idxd->max_engines,
sizeof(struct idxd_engine *),
GFP_KERNEL, dev_to_node(dev));
The saved_engines array is allocated without the __free(kfree) cleanup
attribute. If a memory allocation fails later in the function (for example,
when the device undergoes a reset and memory allocation fails), it jumps to
an error path that returns -ENOMEM.
The idxd_free_saved() function frees the individual structures via
idxd_free_saved_configs(), but assumes the arrays themselves are freed by the
__free cleanup mechanism. Since saved_engines lacks this attribute, is its
memory permanently leaked here?
[Severity: High]
This is a pre-existing issue, but can idxd_free() trigger a double-free
and use-after-free?
Looking at idxd_free() in drivers/dma/idxd/init.c:
static void idxd_free(struct idxd_device *idxd)
{
if (!idxd)
return;
put_device(idxd_confdev(idxd));
bitmap_free(idxd->opcap_bmap);
ida_free(&idxd_ida, idxd->id);
kfree(idxd);
}
When idxd_free() is called on early probe error paths, it first calls
put_device(idxd_confdev(idxd)). This drops the device refcount to 0 and
triggers the idxd_conf_device_release() callback, which explicitly frees
internal structures, calls bitmap_free(idxd->opcap_bmap),
ida_free(&idxd_ida, idxd->id), and then kfree(idxd).
After put_device() returns, idxd_free() immediately repeats these exact
same cleanup steps on the now-freed idxd structure. Does this result in a
direct use-after-free and double-free?
> diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
> index 6d251095c350f..eca96a4dcecd8 100644
> --- a/drivers/dma/idxd/sysfs.c
> +++ b/drivers/dma/idxd/sysfs.c
[ ... ]
[Severity: High]
This is a pre-existing issue, but does idxd_register_devices() have a similar
use-after-free and double-free pattern in its error path?
Looking at idxd_register_devices() in drivers/dma/idxd/sysfs.c:
err_group:
for (i = 0; i < idxd->max_engines; i++)
device_unregister(engine_confdev(idxd->engines[i]));
err_engine:
for (i = 0; i < idxd->max_wqs; i++)
device_unregister(wq_confdev(idxd->wqs[i]));
err_wq:
device_del(idxd_confdev(idxd));
If device_add() fails in idxd_register_wq_devices() or subsequent steps,
this cleanup path calls device_unregister() on previously added engines and
WQs, freeing them. It then calls device_del(idxd_confdev(idxd)), which
unbinds the driver. This invokes idxd_device_drv_remove():
drivers/dma/idxd/device.c:idxd_device_drv_remove() {
...
for (i = 0; i < idxd->max_wqs; i++) {
struct idxd_wq *wq = idxd->wqs[i];
struct device *wq_dev = wq_confdev(wq);
if (wq->state == IDXD_WQ_DISABLED)
continue;
...
}
This loop blindly accesses the WQ states which have already been freed by
the sysfs registration error handler, causing a direct use-after-free.
Furthermore, after idxd_register_devices() returns an error,
idxd_pci_probe_alloc() in drivers/dma/idxd/init.c jumps to err_dev_register:
drivers/dma/idxd/init.c:idxd_pci_probe_alloc() {
...
err_dev_register:
idxd_cleanup(idxd);
...
}
Which eventually calls idxd_clean_wqs():
drivers/dma/idxd/init.c:idxd_clean_wqs() {
...
for (i = 0; i < idxd->max_wqs; i++) {
conf_dev = wq_confdev(idxd->wqs[i]);
put_device(conf_dev);
}
...
}
This blindly drops references on objects that were already freed in the
idxd_register_devices() rollback, triggering a double free.
[Severity: High]
This is a pre-existing issue, but do the registration error paths have an
out-of-bounds array read?
Looking at idxd_register_wq_devices() in drivers/dma/idxd/sysfs.c:
while (j--) {
wq = idxd->wqs[j];
device_unregister(wq_confdev(wq));
}
In idxd_register_wq_devices(), idxd_register_engine_devices(), and
idxd_register_group_devices(), the cleanup paths use j = i - 1 followed by
while (j--).
If device_add() fails on the very first element (i = 0), j becomes -1. The
while (j--) condition evaluates the current value -1 as true (non-zero) and
decrements j to -2. The loop body then accesses index -2 (for example,
idxd->wqs[-2]) and passes the out-of-bounds pointer to device_unregister().
Conversely, if it fails on the second element (i = 1), j becomes 0. The
loop evaluates 0 as false and never executes. Does this skip unregistering
and leak the successfully added element at index 0?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260911065547.161522-1-ziyou.dev@gmail.com?part=1
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] dmaengine: idxd: Fix use-after-free in idxd_remove
2026-09-11 6:55 [PATCH] dmaengine: idxd: Fix use-after-free in idxd_remove Ziyou Wang (Lenovo)
2026-09-11 7:14 ` sashiko-bot
@ 2026-10-30 14:54 ` Frank Li
[not found] ` <CABBdrdLtTJL7-xgB4i=AvqBoBJfFzYvJe+gV+KyLz5=QjUWkCg@mail.gmail.com>
2 siblings, 0 replies; 4+ messages in thread
From: Frank Li @ 2026-10-30 14:54 UTC (permalink / raw)
To: Ziyou Wang (Lenovo)
Cc: Vinod Koul, Vinicius Costa Gomes, Dave Jiang, Frank Li, dmaengine,
linux-kernel, Adrian Huang
On Fri, Sep 11, 2026 at 02:55:47PM +0800, Ziyou Wang (Lenovo) wrote:
> [You don't often get email from ziyou.dev@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> When unbinding the idxd driver, the following call trace is observed:
>
> general protection fault, probably for non-canonical address 0x18fc1d6937256657
> CPU: 117 UID: 0 PID: 3396 Comm: python3 Tainted: G E 7.2.0-rc5-latest+ #11 PREEMPT(lazy)
> Hardware name: Lenovo WenTian WR5220 G5, BIOS speb50m-2.54
> RIP: 0010:__refill_objects_node+0x2da/0x5e0
> Call Trace:
> <TASK>
> refill_objects+0x1ee/0x2e0
> __pcs_replace_empty_main+0x1e1/0x330
> __kmalloc_noprof+0x503/0x550
> ext4_htree_store_dirent+0x34/0x110 [ext4]
> htree_dirblock_to_tree+0x1a9/0x2c0 [ext4]
> ext4_htree_fill_tree+0x246/0x3d0 [ext4]
> ext4_readdir+0x863/0x9d0 [ext4]
> iterate_dir+0xa6/0x260
> __x64_sys_getdents64+0x76/0x130
> do_syscall_64+0x98/0x620
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
> </TASK>
>
> With the KASAN-enabled kernel, the kernel reports a use-after-free bug:
>
> idxd_unregister_devices() calls device_unregister(wq), which triggers
> the wq release callback and frees wq memory via kfree(). However,
> idxd->wqs[] array still holds the freed pointer. Later, when
> device_unregister(idxd) calls idxd_device_drv_remove(), it accesses
> wq->state through idxd->wqs[], resulting in use-after-free.
>
> The same issue exists for idxd->engines[] and idxd->groups[] arrays.
>
> KASAN report:
>
> BUG: KASAN: slab-use-after-free in idxd_device_drv_remove+0xc1/0x100 [idxd]
> Read of size 4 at addr ff1100038d296414 by task python3/3354
> CPU: 20 UID: 0 PID: 3354 Comm: python3 Tainted: G E 7.2.0-rc5-debug+
> Hardware name: Lenovo WenTian WR5220 G5, BIOS speb50m-2.54
>
> Call Trace:
> <TASK>
> dump_stack_lvl+0x5b/0x80
> print_report+0x153/0x4b5
> kasan_report+0xbc/0xf0
> idxd_device_drv_remove+0xc1/0x100 [idxd]
> device_release_driver_internal+0x244/0x2e0
> bus_remove_device+0x195/0x2b0
> device_del+0x24b/0x540
> device_unregister+0x17/0x80
> idxd_remove+0x3f/0x120 [idxd]
> pci_device_remove+0x6d/0xf0
> device_release_driver_internal+0x244/0x2e0
> unbind_store+0xae/0xb0
> kernfs_fop_write_iter+0x205/0x2d0
> vfs_write+0x3a9/0x6b0
> ksys_write+0xc7/0x160
> do_syscall_64+0x9c/0x620
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
> </TASK>
>
> Allocated by task 1219:
> kasan_save_stack+0x20/0x40
> kasan_save_track+0x14/0x30
> __kasan_kmalloc+0x9a/0xb0
> __kmalloc_cache_node_noprof+0x1c6/0x470
> idxd_pci_probe_alloc+0x103f/0x2430 [idxd]
> local_pci_probe+0x71/0xd0
> local_pci_probe_callback+0x20/0x40
> process_one_work+0x389/0x6a0
> worker_thread+0x321+0x590
> kthread+0x1b4/0x200
> ret_from_fork+0x3bd/0x4d0
> ret_from_fork_asm+0x1a/0x30
>
> Freed by task 3354:
> kasan_save_stack+0x20/0x40
> kasan_save_track+0x14/0x30
> kasan_save_free_info+0x3b/0x70
> __kasan_slab_free+0x6b/0x90
> kfree+0x1d4/0x520
> device_release+0x77/0x120
> kobject_put+0xdb/0x2a0
> idxd_unregister_devices+0x5b/0x130 [idxd]
> idxd_remove+0x2f/0x120 [idxd]
> pci_device_remove+0x6d/0xf0
> device_release_driver_internal+0x244/0x2e0
> unbind_store+0xae/0xb0
> kernfs_fop_write_iter+0x205/0x2d0
> vfs_write+0x3a9/0x6b0
> ksys_write+0xc7/0x160
> do_syscall_64+0x9c/0x620
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
Can you trim dump to make commit message short.
>
> Fix by taking refs on wq/engine/group conf_dev in idxd_unregister_devices()
> before calling device_unregister(). This prevents their memory from being
> freed until after idxd_device_drv_remove() completes. Add idxd_put_devices()
> to release the refs after all cleanup activities are done.
>
> To reproduce:
> cd dsa-perf-micros
> ./scripts/setup_dsa.sh -d dsa0 -w 1 -m s -e 4
> echo "0000:00:01.0" > /sys/bus/pci/drivers/idxd/unbind
This is typical unbind driver method. So needn't this paragraph.
Frank
>
> Fixes: 47c16ac27d4c ("dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime")
> Suggested-by: Adrian Huang (Lenovo) <adrianhuang0701@gmail.com>
> Signed-off-by: Ziyou Wang (Lenovo) <ziyou.dev@gmail.com>
> ---
> Added a Suggested-by tag for Adrian, as he came up with the idea for this patch.
>
> drivers/dma/idxd/init.c | 15 +++++++++++++++
> drivers/dma/idxd/sysfs.c | 8 ++++++++
> 2 files changed, 23 insertions(+)
>
> diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
> index 4b827a329756..212efbfebacc 100644
> --- a/drivers/dma/idxd/init.c
> +++ b/drivers/dma/idxd/init.c
> @@ -1263,6 +1263,20 @@ static void idxd_shutdown(struct pci_dev *pdev)
> flush_workqueue(idxd->wq);
> }
>
> +static void idxd_put_devices(struct idxd_device *idxd)
> +{
> + int i;
> +
> + for (i = 0; i < idxd->max_wqs; i++)
> + put_device(wq_confdev(idxd->wqs[i]));
> +
> + for (i = 0; i < idxd->max_engines; i++)
> + put_device(engine_confdev(idxd->engines[i]));
> +
> + for (i = 0; i < idxd->max_groups; i++)
> + put_device(group_confdev(idxd->groups[i]));
> +}
> +
> static void idxd_remove(struct pci_dev *pdev)
> {
> struct idxd_device *idxd = pci_get_drvdata(pdev);
> @@ -1284,6 +1298,7 @@ static void idxd_remove(struct pci_dev *pdev)
> if (device_pasid_enabled(idxd))
> idxd_disable_system_pasid(idxd);
> pci_iounmap(pdev, idxd->reg_base);
> + idxd_put_devices(idxd);
> put_device(idxd_confdev(idxd));
> pci_disable_device(pdev);
> }
> diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
> index 6d251095c350..eca96a4dcecd 100644
> --- a/drivers/dma/idxd/sysfs.c
> +++ b/drivers/dma/idxd/sysfs.c
> @@ -1988,21 +1988,29 @@ void idxd_unregister_devices(struct idxd_device *idxd)
> {
> int i;
>
> + /*
> + * Take a reference count to the idxd device to prevent the
> + * corresponding idxd context from being freed, as the driver
> + * still needs it for the remaining cleanup operations.
> + */
> for (i = 0; i < idxd->max_wqs; i++) {
> struct idxd_wq *wq = idxd->wqs[i];
>
> + get_device(wq_confdev(wq));
> device_unregister(wq_confdev(wq));
> }
>
> for (i = 0; i < idxd->max_engines; i++) {
> struct idxd_engine *engine = idxd->engines[i];
>
> + get_device(engine_confdev(engine));
> device_unregister(engine_confdev(engine));
> }
>
> for (i = 0; i < idxd->max_groups; i++) {
> struct idxd_group *group = idxd->groups[i];
>
> + get_device(group_confdev(group));
> device_unregister(group_confdev(group));
> }
> }
> --
> 2.53.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread[parent not found: <CABBdrdLtTJL7-xgB4i=AvqBoBJfFzYvJe+gV+KyLz5=QjUWkCg@mail.gmail.com>]
* Re: [PATCH] dmaengine: idxd: Fix use-after-free in idxd_remove
[not found] ` <CABBdrdLtTJL7-xgB4i=AvqBoBJfFzYvJe+gV+KyLz5=QjUWkCg@mail.gmail.com>
@ 2026-10-31 0:13 ` Vinicius Costa Gomes
0 siblings, 0 replies; 4+ messages in thread
From: Vinicius Costa Gomes @ 2026-10-31 0:13 UTC (permalink / raw)
To: Ziyou Wang, Vinod Koul
Cc: Dave Jiang, Frank Li, dmaengine, linux-kernel, Adrian Huang
Hi Ziyou,
Ziyou Wang <ziyou.dev@gmail.com> writes:
> Hi Vinod,
>
> Gentle ping on this patch.
>
> This fixes a use-after-free bug that can be triggered when unbinding
> the idxd driver, which results in a kernel crash. The fix has been
> tested on real hardware (Lenovo WenTian WR5220 G5) and verified with
> KASAN.
>
> The issue is critical as it causes general protection fault during
> driver unbind. The fix is straightforward - taking reference counts
> on wq/engine/group conf_dev before unregistering to prevent premature
> freeing.
>
> Please let me know if any changes are needed or if you need more
> information.
>
It looks very similar to the issue that
https://lore.kernel.org/all/20260415095030.42183-1-kanie@linux.alibaba.com/
tries to fix, can you confirm that it solves the issue you are seeing?
Cheers,
--
Vinicius
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-31 0:13 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-11 6:55 [PATCH] dmaengine: idxd: Fix use-after-free in idxd_remove Ziyou Wang (Lenovo)
2026-09-11 7:14 ` sashiko-bot
2026-10-30 14:54 ` Frank Li
[not found] ` <CABBdrdLtTJL7-xgB4i=AvqBoBJfFzYvJe+gV+KyLz5=QjUWkCg@mail.gmail.com>
2026-10-31 0:13 ` Vinicius Costa Gomes
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox