linux-kernel - Re: [PATCH RESEND v3 0/2] dmaengine: idxd: Fix refcount and cleanup issues on module unload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aJr10DimV4k8oxQQ@ly-workstation>
Date: Tue, 12 Aug 2025 16:05:36 +0800
From: "Lai, Yi" <yi1.lai@...ux.intel.com>
To: Yi Sun <yi.sun@...el.com>
Cc: vinicius.gomes@...el.com, vkoul@...nel.org, dave.jiang@...el.com,
	fenghuay@...dia.com, xueshuai@...ux.alibaba.com,
	dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org,
	gordon.jin@...el.com
Subject: Re: [PATCH RESEND v3 0/2] dmaengine: idxd: Fix refcount and cleanup
 issues on module unload

On Tue, Jul 29, 2025 at 11:03:11PM +0800, Yi Sun wrote:
> This patch series addresses two issues related to the device reference
> counting and cleanup path in the idxd driver.
> 
> Recent changes introduced improper put_device() calls and duplicated
> cleanup logic, leading to refcount underflow and potential use-after-free
> during module unload.
> 
> Patch 1 removes an unnecessary call to idxd_free(), which could result in a
> use-after-free, because the function idxd_conf_device_release already
> covers everything done in idxd_free. The newly added idxd_free in commit
> 90022b3 doesn't resolve any memory leaks, but introduces several duplicated
> cleanup.
> 
> Patch 2 refactors the cleanup to avoid redundant put_device() calls
> introduced in commit a409e919ca3. The existing idxd_unregister_devices()
> already handles proper device reference release.
> 
> Both patches have been verified on hardware platform.
> 
> Both patches have been run through `checkpatch.pl`. Patch 2 gets 1 error
> and 1 warning. But these appear to be limitations in the checkpatch script
> itself, not reflect issues with the patches.
> 
> ---
> Changes in V3:
> - Removed function idxd_disable_sva which got removed recently (Vinicius)
> Changes in v2:
> - Reworded commit messages supplementing the call traces (Vinicius)
> - Explain why the put_device are unnecessary. (Vinicius)
> 
> Yi Sun (2):
>   dmaengine: idxd: Remove improper idxd_free
>   dmaengine: idxd: Fix refcount underflow on module unload
> 
>  drivers/dma/idxd/init.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>

Applied patch series on top of v6.17-rc1 kernel. Issue is fixed.

Please help add Tested-by: Yi Lai <yi1.lai@...el.com>

Regards,
Yi Lai
> -- 
> 2.43.0