Re: [PATCH] PCI: endpoint: Fix configfs group removal on driver teardown

[Niklas Cassel <cassel@kernel.org>]

On Mon, Jun 23, 2025 at 09:01:53PM +0900, Damien Le Moal wrote:
> On 6/23/25 19:00, Niklas Cassel wrote:
> > 
> > I think it is a litte bit confusing that you attach a KASAN
> > splat to a patch that fixes two different bugs.
> > 
> > Surely this KASAN bug can be fixes with only:
> > 
> > -     list_del(&driver->epf_group);
> > +     WARN_ON(!list_empty(&driver->epf_group));
> 
> Yes, with that, you will not get the KASAN warning, but you will get the
> WARN_ON() to trigger unless bug #1 is applied first. But if you apply #1 first,
> then any testing done with that bug fix only will trigger a NULL pointer
> de-reference on the list_del().

Ok, let me rephrase :)

Surely this KASAN bug can be fixed with only:

-     list_del(&driver->epf_group);

As the bug is that the code is trying to delete a list head, which is just
wrong.


A patch 2/2 could add a list_del() to pci_ep_cfs_remove_epf_group() and the
WARN_ON() to pci_epf_remove_cfs().

Considering that pci_ep_cfs_remove_epf_group() also frees the memory for
the group, I think it is more correct to use list_del() rather than
list_del_init(), as no one will be able to re-use this group after calling
pci_ep_cfs_remove_epf_group() on it.


Kind regards,
Niklas