Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] cla: missing KVM refcount failure handling causes UAF --
commit 2dbcc26b5b7fa32dbb9707b12991d8ab79134d92 Author: Jean-Philippe Brucker <[email protected]> misc/arm-cla: Support exclusive context assignment This commit introduces a nr_contexts member to cla_domain to track mapped contexts. It allows PL0 contexts to share the domain while enforcing exclusive assignment for PL1 contexts by using a negative count. > diff --git a/drivers/misc/arm-cla/cla-ctx.c b/drivers/misc/arm-cla/cla-ctx.c > index 0489bf7a103f9..f956cc88909f8 100644 > --- a/drivers/misc/arm-cla/cla-ctx.c > +++ b/drivers/misc/arm-cla/cla-ctx.c [ ... ] > @@ -116,6 +153,8 @@ struct cla_ctx *cla_ctx_create(struct cla_domain *domain, > cla_ctx_put_pl1(ctx); > } > kfree(ctx); > +err_put_domain: > + cla_domain_put(domain); > err_unlock: > mutex_unlock(&domain->lock); > return ERR_PTR(ret); [Severity: High] Earlier in cla_ctx_create(), if cla_ctx_get_pl1() fails to acquire a reference to KVM (e.g., if the VM is being torn down concurrently and its refcount is already zero), the failure is ignored: } else { WARN_ON(!cla_ctx_get_pl1(ctx)); } The context creation continues with a potentially freed KVM pointer. If an error occurs later in the function (such as cla_mtc_get_ctx() failing) and we take the err_free path, or when the context is eventually destroyed, cla_ctx_put_pl1() is unconditionally called. Does this cause a use-after-free and a refcount underflow of the kvm object, since the reference was never actually acquired? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=14
