Skip to content

Commit 759765c

Browse files
emuslnNipaLocal
authored and
NipaLocal
committed
pds_core: remove write-after-free of client_id
A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-kernel-patches#47): [Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0x70 [Mon Apr 21 21:21:33 2025] device_release_driver_internal+0x11f/0x180 [Mon Apr 21 21:21:33 2025] driver_detach+0x45/0x80 [Mon Apr 21 21:21:33 2025] bus_remove_driver+0x83/0xe0 [Mon Apr 21 21:21:33 2025] pci_unregister_driver+0x1a/0x80 The actual device uninit usually happens on a separate thread scheduled after this code runs, but there is no guarantee of order of thread execution, so this could be a problem. There's no actual need to clear the client_id at this point, so simply remove the offending code. Fixes: 1065903 ("pds_core: add the aux client API") Signed-off-by: Shannon Nelson <shannon.nelson@amd.com> Signed-off-by: NipaLocal <nipa@local>
1 parent b2be50f commit 759765c

File tree

1 file changed

+0
-1
lines changed
  • drivers/net/ethernet/amd/pds_core

1 file changed

+0
-1
lines changed

drivers/net/ethernet/amd/pds_core/auxbus.c

-1
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,6 @@ void pdsc_auxbus_dev_del(struct pdsc *cf, struct pdsc *pf,
186186
pds_client_unregister(pf, padev->client_id);
187187
auxiliary_device_delete(&padev->aux_dev);
188188
auxiliary_device_uninit(&padev->aux_dev);
189-
padev->client_id = 0;
190189
*pd_ptr = NULL;
191190

192191
mutex_unlock(&pf->config_lock);

0 commit comments

Comments
 (0)