Re: [PATCH] mcb: fix KASAN bug slab-use-after-free while removing mcb-pci

[Johannes Thumshirn <morbidrsa@gmail.com>]

On 4/27/26 3:46 PM, Jose Javier Rodriguez Barbarin wrote:
> Fix KASAN bug reported when removing mcb-pci module.
>
> slab-use-after-free in mcb_release_bus drivers/mcb/mcb-core.c:73
> Read of size 8 at addr ffff888101e52060 by task modprobe/4993
>
> mcb_release_bus+0x3e/0x40 drivers/mcb/mcb-core.c:73
> mcb_pci_remove+0x4e/0x70 [mcb_pci]
> pci_device_remove+0xaa/0x1d0 drivers/pci/pci-driver.c:503
> ...
>
> The bug is caused by an incorrect usage of bus_for_each_dev(), thus
> if there are more than one pci mcb board, __mcb_bus_add_devices()
> adds all bus devices recursively, so for mcb:0 it adds its devices
> and for mcb:1 it adds the devices of mcb:0 and mcb:1.
>
> The same behaviour is observed on __mcb_devices_unregister(). So
> when unregistering process happens, for mcb:1, all devices are unregisted,
> even the devices of mcb:0 so when mcb:0 tries to unregister its
> devices, slab-use-after-free happens.
>
> To fix that, just register/unregister the devices on the correct bus.
> Additonally, with this change, mcb_bus have to be explicitly unregistered.
>
> Reviewed-by: Filip Jensen <dev-Felipe.Jensen@duagon.com>
> Signed-off-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>


Looks good, thanks.