mirror of https://github.com/torvalds/linux.git
dfd76010f8
A use-after-free error popped up in stress testing:
[Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core]
[Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47):
[Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core]
[Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core]
[Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0x70
[Mon Apr 21 21:21:33 2025] device_release_driver_internal+0x11f/0x180
[Mon Apr 21 21:21:33 2025] driver_detach+0x45/0x80
[Mon Apr 21 21:21:33 2025] bus_remove_driver+0x83/0xe0
[Mon Apr 21 21:21:33 2025] pci_unregister_driver+0x1a/0x80
The actual device uninit usually happens on a separate thread
scheduled after this code runs, but there is no guarantee of order
of thread execution, so this could be a problem. There's no
actual need to clear the client_id at this point, so simply
remove the offending code.
Fixes:
|
||
|---|---|---|
| .. | ||
| pds_core | ||
| xgbe | ||
| 7990.c | ||
| 7990.h | ||
| Kconfig | ||
| Makefile | ||
| a2065.c | ||
| a2065.h | ||
| amd8111e.c | ||
| amd8111e.h | ||
| ariadne.c | ||
| ariadne.h | ||
| atarilance.c | ||
| au1000_eth.c | ||
| au1000_eth.h | ||
| declance.c | ||
| hplance.c | ||
| hplance.h | ||
| lance.c | ||
| mvme147.c | ||
| nmclan_cs.c | ||
| pcnet32.c | ||
| sun3lance.c | ||
| sunlance.c | ||