linux-kernel - [PATCH v2] block: mtip32xx: Prioritize state cleanup over memory freeing in the mtip_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250823083222.3137817-1-zhangheng@kylinos.cn>
Date: Sat, 23 Aug 2025 16:32:22 +0800
From: Zhang Heng <zhangheng@...inos.cn>
To: axboe@...nel.dk,
	phasta@...nel.org,
	andriy.shevchenko@...ux.intel.com,
	broonie@...nel.org,
	lizetao1@...wei.com,
	viro@...iv.linux.org.uk,
	fourier.thomas@...il.com,
	anuj20.g@...sung.com
Cc: linux-block@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Zhang Heng <zhangheng@...inos.cn>
Subject: [PATCH v2] block: mtip32xx: Prioritize state cleanup over memory freeing in the mtip_pci_probe error path.

The original sequence kfree(dd); pci_set_drvdata(pdev, NULL); creates a
theoretical race condition window. Between these two calls, the pci_dev
structure retains a dangling pointer to the already-freed device private
data (dd). Any concurrent access to the drvdata (e.g., from an interrupt
handler or an unexpected call to remove) would lead to a use-after-free
kernel oops.

Changes made:
1. `pci_set_drvdata(pdev, NULL);` - First, atomically sever the link
from the pci_dev.
2. `kfree(dd);` - Then, safely free the private memory.

This ensures the kernel state is always consistent before resources
are released, adhering to defensive programming principles.

Signed-off-by: Zhang Heng <zhangheng@...inos.cn>
---
 drivers/block/mtip32xx/mtip32xx.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 8fc7761397bd..f228363e6b1c 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -3839,9 +3839,8 @@ static int mtip_pci_probe(struct pci_dev *pdev,
 	}

 iomap_err:
-	kfree(dd);
 	pci_set_drvdata(pdev, NULL);
-	return rv;
+	kfree(dd);
 done:
 	return rv;
 }
-- 
2.47.1