Re: [PATCH v7 1/7] cxl/test: Add test for module parameters

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing Use-After-Free due to static `struct platform_device` inside a loadable module.
--

commit 6c236a64c339f0b27ff963a194f46fc253545d89
Author: Dave Jiang <dave.jiang@intel.com>

cxl/test: Add test for module parameters

Add a test for module paraters during module init to make sure that
only one is activated.

> diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c
> index ef92dd35e030c..198a128181b93 100644
> --- a/tools/testing/cxl/test/cxl.c
> +++ b/tools/testing/cxl/test/cxl.c

[ ... ]

> diff --git a/tools/testing/cxl/test/hmem_test.c b/tools/testing/cxl/test/hmem_test.c
> index 3a1a089e1721b..0fa00f7e16db5 100644
> --- a/tools/testing/cxl/test/hmem_test.c
> +++ b/tools/testing/cxl/test/hmem_test.c
> @@ -3,8 +3,9 @@
>  #include <linux/moduleparam.h>
>  #include <linux/workqueue.h>
>  #include "../../../drivers/dax/bus.h"
> +#include "mock.h"
>  
> -static bool hmem_test;
> +bool hmem_test;

[Severity: High]
This is a pre-existing issue, but could this module encounter a use-after-free
on unload due to how platform_device is managed in this file?

Looking at hmem_test_exit() and the hmem_test_device definition:

static struct hmem_platform_device hmem_test_device = {
    ...
};

void hmem_test_exit(void)
{
    if (hmem_test)
        platform_device_unregister(&hmem_test_device.pdev);
}

If the dax_hmem driver has queued work on dax_hmem_wq (which holds a reference
to the device via get_device()), platform_device_unregister() doesn't appear
to synchronously wait for those references to drop or for the work to complete
because dax_hmem_platform_driver lacks a remove() callback to cancel the work.

Since hmem_test_device is statically allocated in the module's data section,
once the module memory is freed on unload, would the kernel access unmapped
memory when the delayed work executes, or when the final reference drops and
invokes the unmapped hmem_test_release() function?

>  
>  static void hmem_test_work(struct work_struct *work)
>  {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629221104.3891733-1-dave.jiang@intel.com?part=1