linux-kernel - Re: [PATCH 05/15] dmaengine: idxd: fix device leaks on compat bind and unbind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <867fa85c-8e7d-4b60-a354-630d4147c3ea@intel.com>
Date: Mon, 17 Nov 2025 09:18:39 -0700
From: Dave Jiang <dave.jiang@...el.com>
To: Johan Hovold <johan@...nel.org>, Vinod Koul <vkoul@...nel.org>
Cc: Ludovic Desroches <ludovic.desroches@...rochip.com>,
 Viresh Kumar <vireshk@...nel.org>,
 Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
 Vinicius Costa Gomes <vinicius.gomes@...el.com>,
 Vladimir Zapolskiy <vz@...ia.com>,
 Piotr Wojtaszczyk <piotr.wojtaszczyk@...esys.com>,
 Amélie Delaunay <amelie.delaunay@...s.st.com>,
 Maxime Coquelin <mcoquelin.stm32@...il.com>,
 Alexandre Torgue <alexandre.torgue@...s.st.com>,
 Peter Ujfalusi <peter.ujfalusi@...il.com>, dmaengine@...r.kernel.org,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH 05/15] dmaengine: idxd: fix device leaks on compat bind
 and unbind



On 11/17/25 9:12 AM, Johan Hovold wrote:
> Make sure to drop the reference taken when looking up the idxd device as
> part of the compat bind and unbind sysfs interface.
> 
> Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode")
> Cc: stable@...r.kernel.org	# 5.15
> Cc: Dave Jiang <dave.jiang@...el.com>
> Signed-off-by: Johan Hovold <johan@...nel.org>

Reviewed-by: Dave Jiang <dave.jiang@...el.com>> ---
>  drivers/dma/idxd/compat.c | 23 +++++++++++++++++++----
>  1 file changed, 19 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/dma/idxd/compat.c b/drivers/dma/idxd/compat.c
> index eff9943f1a42..95b8ef958633 100644
> --- a/drivers/dma/idxd/compat.c
> +++ b/drivers/dma/idxd/compat.c
> @@ -20,11 +20,16 @@ static ssize_t unbind_store(struct device_driver *drv, const char *buf, size_t c
>  	int rc = -ENODEV;
>  
>  	dev = bus_find_device_by_name(bus, NULL, buf);
> -	if (dev && dev->driver) {
> +	if (!dev)
> +		return -ENODEV;
> +
> +	if (dev->driver) {
>  		device_driver_detach(dev);
>  		rc = count;
>  	}
>  
> +	put_device(dev);
> +
>  	return rc;
>  }
>  static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, 0200, NULL, unbind_store);
> @@ -38,9 +43,12 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf, size_t cou
>  	struct idxd_dev *idxd_dev;
>  
>  	dev = bus_find_device_by_name(bus, NULL, buf);
> -	if (!dev || dev->driver || drv != &dsa_drv.drv)
> +	if (!dev)
>  		return -ENODEV;
>  
> +	if (dev->driver || drv != &dsa_drv.drv)
> +		goto err_put_dev;
> +
>  	idxd_dev = confdev_to_idxd_dev(dev);
>  	if (is_idxd_dev(idxd_dev)) {
>  		alt_drv = driver_find("idxd", bus);
> @@ -53,13 +61,20 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf, size_t cou
>  			alt_drv = driver_find("user", bus);
>  	}
>  	if (!alt_drv)
> -		return -ENODEV;
> +		goto err_put_dev;
>  
>  	rc = device_driver_attach(alt_drv, dev);
>  	if (rc < 0)
> -		return rc;
> +		goto err_put_dev;
> +
> +	put_device(dev);
>  
>  	return count;
> +
> +err_put_dev:
> +	put_device(dev);
> +
> +	return rc;
>  }
>  static DRIVER_ATTR_IGNORE_LOCKDEP(bind, 0200, NULL, bind_store);
>