linux-kernel - [PATCH RESEND v3 0/2] dmaengine: idxd: Fix refcount and cleanup issues on module unload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250729150313.1934101-1-yi.sun@intel.com>
Date: Tue, 29 Jul 2025 23:03:11 +0800
From: Yi Sun <yi.sun@...el.com>
To: vinicius.gomes@...el.com,
	vkoul@...nel.org,
	dave.jiang@...el.com,
	fenghuay@...dia.com,
	xueshuai@...ux.alibaba.com
Cc: dmaengine@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	yi.sun@...el.com,
	gordon.jin@...el.com
Subject: [PATCH RESEND v3 0/2] dmaengine: idxd: Fix refcount and cleanup issues on module unload

This patch series addresses two issues related to the device reference
counting and cleanup path in the idxd driver.

Recent changes introduced improper put_device() calls and duplicated
cleanup logic, leading to refcount underflow and potential use-after-free
during module unload.

Patch 1 removes an unnecessary call to idxd_free(), which could result in a
use-after-free, because the function idxd_conf_device_release already
covers everything done in idxd_free. The newly added idxd_free in commit
90022b3 doesn't resolve any memory leaks, but introduces several duplicated
cleanup.

Patch 2 refactors the cleanup to avoid redundant put_device() calls
introduced in commit a409e919ca3. The existing idxd_unregister_devices()
already handles proper device reference release.

Both patches have been verified on hardware platform.

Both patches have been run through `checkpatch.pl`. Patch 2 gets 1 error
and 1 warning. But these appear to be limitations in the checkpatch script
itself, not reflect issues with the patches.

---
Changes in V3:
- Removed function idxd_disable_sva which got removed recently (Vinicius)
Changes in v2:
- Reworded commit messages supplementing the call traces (Vinicius)
- Explain why the put_device are unnecessary. (Vinicius)

Yi Sun (2):
  dmaengine: idxd: Remove improper idxd_free
  dmaengine: idxd: Fix refcount underflow on module unload

 drivers/dma/idxd/init.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

-- 
2.43.0