Re: [PATCH v3] cxl/core: Fix dport use-after-free via the einj_inject debugfs file

[Alison Schofield <alison.schofield@intel.com>]

On Fri, Aug 28, 2026 at 03:47:52PM +0800, Guixin Liu wrote:
> The per-dport einj_inject debugfs file retains a pointer to the
> 'struct cxl_dport', but its lifetime is not tied to the dport. Unbinding
> the dport host frees the dport and leaves einj_inject behind, so writing
> the file dereferences freed memory:
> 
>   BUG: KASAN: slab-use-after-free in cxl_einj_inject+0xa1/0xf0 [cxl_core]
>   Read of size 1 at addr ffff88810880ac90 by task bash/1690
>    cxl_einj_inject+0xa1/0xf0 [cxl_core]
>    debugfs_attr_write+0x61/0xb0
>    full_proxy_write+0xfc/0x1c0
>    vfs_write+0x1d4/0xe60
>   Allocated by task 213:
>    __devm_cxl_add_dport+0x1e1/0x14d0 [cxl_core]
>    cxl_port_add_dport+0xd6/0x200 [cxl_port]
>   Freed by task 1622:
>    release_nodes+0xfa/0x2c0
>    devres_release_all+0x113/0x1a0
>    device_unbind_cleanup+0x76/0x260
>    unbind_store+0xde/0x100
> 
> The stale directory also prevents recreation on rebind.
> 
> Remove the per-dport debugfs directory when the dport host is released.
> 
> Found by code inspection, then reproduced on a QEMU CXL topology with
> KASAN (the einj_cxl_is_initialized() guard had to be forced open, as
> QEMU emits no EINJ table). Unpatched, writing the leftover file after
> unbind gives the splat above, and rebind hits "already exists in
> 'cxl'". Patched, the directory goes away with the dport and rebind
> recreates a working einj_inject.
> 
> Fixes: 8039804cfa73 ("cxl/core: Add CXL EINJ debugfs files")
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
> Reviewed-by: Richard Cheng <icheng@nvidia.com>
> Reviewed-by: Li Ming <ming.li@zohomail.com>

Thanks for the changelog updatges Guixin.

DaveJ - KASAN trace could be left out upon applying.

Reviewed-by: Alison Schofield <alison.schofield@intel.com>