Re: [PATCH] cxl/core: Skip einj_inject creation when devm_add_action_or_reset() fails

[Dave Jiang <dave.jiang@intel.com>]

On 9/14/26 11:01 PM, Guixin Liu wrote:
> cxl_debugfs_create_dport_dir() ignores the devm_add_action_or_reset()
> result and creates the einj_inject file below @dir unconditionally.
> 
> When the devres allocation fails, remove_debugfs() has already run
> before devm_add_action_or_reset() returns, i.e. debugfs_remove() has
> released @dir. The subsequent debugfs_create_file() would then use
> that dentry as its parent although its final reference was dropped in
> the removal and its memory is subject to call_rcu() delayed freeing.
> 
> Skip the file creation in that case, consistent with how the rest of
> the helper tolerates debugfs failures.
> 
> Fixes: 9185b1a3043c ("cxl/core: Fix dport use-after-free via the einj_inject debugfs file")
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>

Applied to cxl/next:
b25af6afd2f2

> ---
>  drivers/cxl/core/port.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
> index 8d715739995b..95c0be57ed53 100644
> --- a/drivers/cxl/core/port.c
> +++ b/drivers/cxl/core/port.c
> @@ -837,7 +837,8 @@ static void cxl_debugfs_create_dport_dir(struct cxl_dport *dport)
>  
>  	dir = cxl_debugfs_create_dir(dev_name(dport->dport_dev));
>  
> -	devm_add_action_or_reset(dport_to_host(dport), remove_debugfs, dir);
> +	if (devm_add_action_or_reset(dport_to_host(dport), remove_debugfs, dir))
> +		return;
>  
>  	debugfs_create_file("einj_inject", 0200, dir, dport,
>  			    &cxl_einj_inject_fops);