linux-kernel - Re: [PATCH v3 1/2] dmaengine: idxd: Remove improper idxd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d4b51d33-e46b-448d-b6d3-f0845b1d05f8@nvidia.com>
Date: Tue, 17 Jun 2025 15:13:22 -0700
From: Fenghua Yu <fenghuay@...dia.com>
To: Yi Sun <yi.sun@...el.com>, vinicius.gomes@...el.com,
 dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org
Cc: dave.jiang@...el.com, gordon.jin@...el.com
Subject: Re: [PATCH v3 1/2] dmaengine: idxd: Remove improper idxd_free

Hi, Yi,

On 6/17/25 03:27, Yi Sun wrote:
> The call to idxd_free() introduces a duplicate put_device() leading to a
> reference count underflow:
> refcount_t: underflow; use-after-free.
> WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
> ...
> Call Trace:
>   <TASK>
>    idxd_remove+0xe4/0x120 [idxd]
>    pci_device_remove+0x3f/0xb0
>    device_release_driver_internal+0x197/0x200
>    driver_detach+0x48/0x90
>    bus_remove_driver+0x74/0xf0
>    pci_unregister_driver+0x2e/0xb0
>    idxd_exit_module+0x34/0x7a0 [idxd]
>    __do_sys_delete_module.constprop.0+0x183/0x280
>    do_syscall_64+0x54/0xd70
>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> The idxd_unregister_devices() which is invoked at the very beginning of
> idxd_remove(), already takes care of the necessary put_device() through the
> following call path:
> idxd_unregister_devices() -> device_unregister() -> put_device()
>
> In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may
> trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is
> called immediately after, it can result in a use-after-free.
>
> Remove the improper idxd_free() to avoid both the refcount underflow and
> potential memory corruption during module unload.
>
> Fixes: d5449ff1b04d ("dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call")
> Signed-off-by: Yi Sun <yi.sun@...el.com>
>
> diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
> index 80355d03004d..40cc9c070081 100644
> --- a/drivers/dma/idxd/init.c
> +++ b/drivers/dma/idxd/init.c
> @@ -1295,7 +1295,6 @@ static void idxd_remove(struct pci_dev *pdev)
>   	idxd_cleanup(idxd);
>   	pci_iounmap(pdev, idxd->reg_base);
>   	put_device(idxd_confdev(idxd));
> -	idxd_free(idxd);

Simply removing idxd_free() causes two issues:

1. This hits memory leak issues because allocated idxd, ida, map are not 
freed.

2. There is still an underflow issue for dev refcnt in 
idxd_pci_probe_alloc() when idxd_register_devices() fails. Here 
get_device() is not called but put_device() is called.

A right fix is to remove the put_device() in idxd_free(). This will fix 
all the above issues.

Thanks.

-Fenghua