linux-kernel - Re: [PATCH v4 4/4] uacce: ensure safe queue release with state management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABQgh9GDMohphD82y_uf0EfVMz1f3hHTnZ-fot9W0oFdq4oJPA@mail.gmail.com>
Date: Mon, 10 Nov 2025 15:26:11 +0800
From: Zhangfei Gao <zhangfei.gao@...aro.org>
To: Chenghai Huang <huangchenghai2@...wei.com>
Cc: gregkh@...uxfoundation.org, wangzhou1@...ilicon.com, 
	linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org, 
	fanghao11@...wei.com, shenyang39@...wei.com, liulongfang@...wei.com, 
	qianweili@...wei.com, linwenkai6@...ilicon.com
Subject: Re: [PATCH v4 4/4] uacce: ensure safe queue release with state management

On Wed, 22 Oct 2025 at 10:12, Chenghai Huang <huangchenghai2@...wei.com> wrote:
>
> Directly calling `put_queue` carries risks since it cannot
> guarantee that resources of `uacce_queue` have been fully released
> beforehand. So adding a `stop_queue` operation for the
> UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to
> the final resource release ensures safety.
>
> Queue states are defined as follows:
> - UACCE_Q_ZOMBIE: Initial state
> - UACCE_Q_INIT: After opening `uacce`
> - UACCE_Q_STARTED: After `start` is issued via `ioctl`
>
> When executing `poweroff -f` in virt while accelerator are still
> working, `uacce_fops_release` and `uacce_remove` may execute
> concurrently. This can cause `uacce_put_queue` within
> `uacce_fops_release` to access a NULL `ops` pointer. Therefore, add
> state checks to prevent accessing freed pointers.
>
> Fixes: 015d239ac014 ("uacce: add uacce driver")
> Cc: stable@...r.kernel.org
> Signed-off-by: Chenghai Huang <huangchenghai2@...wei.com>
> Signed-off-by: Yang Shen <shenyang39@...wei.com>

Acked-by: Zhangfei Gao <zhangfei.gao@...aro.org>

Thanks