linux-kernel - [PATCH RESEND v2 03/10] dmaengine: idxd: Fix possible invalid memory access after FLR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260115-idxd-fix-flr-on-kernel-queues-v3-v2-3-59e106115a3e@intel.com>
Date: Thu, 15 Jan 2026 14:47:21 -0800
From: Vinicius Costa Gomes <vinicius.gomes@...el.com>
To: Dave Jiang <dave.jiang@...el.com>, Vinod Koul <vkoul@...nel.org>, 
 Dan Williams <dan.j.williams@...el.com>
Cc: dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org, 
 Vinicius Costa Gomes <vinicius.gomes@...el.com>
Subject: [PATCH RESEND v2 03/10] dmaengine: idxd: Fix possible invalid
 memory access after FLR

In the case that the first Function Level Reset (FLR) concludes
correctly, but in the second FLR the scratch area for the saved
configuration cannot be allocated, it's possible for a invalid memory
access to happen.

Always set the deallocated scratch area to NULL after FLR completes.

Fixes: 98d187a98903 ("dmaengine: idxd: Enable Function Level Reset (FLR) for halt")
Reviewed-by: Dave Jiang <dave.jiang@...el.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@...el.com>
---
 drivers/dma/idxd/init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
index 1c3f9bc7364b..f1cfc7790d95 100644
--- a/drivers/dma/idxd/init.c
+++ b/drivers/dma/idxd/init.c
@@ -1146,6 +1146,7 @@ static void idxd_reset_done(struct pci_dev *pdev)
 	}
 out:
 	kfree(idxd->idxd_saved);
+	idxd->idxd_saved = NULL;
 }
 
 static const struct pci_error_handlers idxd_error_handler = {

-- 
2.52.0