diff options
| author | Shannon Nelson <shannon.nelson@amd.com> | 2025-04-25 23:38:57 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2025-04-29 01:54:30 +0300 |
| commit | dfd76010f8e821b66116dec3c7d90dd2403d1396 (patch) | |
| tree | 56a0932abf3b71ebec159082b7b0772062f2c136 /lib/mpi/mpi-pow.c | |
| parent | a54b2e2d40b47aa5d283cd637c4e172da231461e (diff) | |
| download | linux-dfd76010f8e821b66116dec3c7d90dd2403d1396.tar.xz | |
pds_core: remove write-after-free of client_id
A use-after-free error popped up in stress testing:
[Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core]
[Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47):
[Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core]
[Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core]
[Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0x70
[Mon Apr 21 21:21:33 2025] device_release_driver_internal+0x11f/0x180
[Mon Apr 21 21:21:33 2025] driver_detach+0x45/0x80
[Mon Apr 21 21:21:33 2025] bus_remove_driver+0x83/0xe0
[Mon Apr 21 21:21:33 2025] pci_unregister_driver+0x1a/0x80
The actual device uninit usually happens on a separate thread
scheduled after this code runs, but there is no guarantee of order
of thread execution, so this could be a problem. There's no
actual need to clear the client_id at this point, so simply
remove the offending code.
Fixes: 10659034c622 ("pds_core: add the aux client API")
Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250425203857.71547-1-shannon.nelson@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'lib/mpi/mpi-pow.c')
0 files changed, 0 insertions, 0 deletions