Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] vhost_vdpa: Use-After-Free of parent vdpa_device on probe failure --
commit b1425fc64c0e35d298bf8e859d19dd2bf03f896d Author: Linfeng Sun <[email protected]> vhost-vdpa: initialize state before publishing cdev Initialize the completion and as hash buckets before cdev_device_add() makes the device accessible. > diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c > index ff7d907191712..35e2f5b2293bf 100644 > --- a/drivers/vhost/vdpa.c > +++ b/drivers/vhost/vdpa.c > @@ -1678,17 +1678,16 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa) > > cdev_init(&v->cdev, &vhost_vdpa_fops); > v->cdev.owner = THIS_MODULE; > + init_completion(&v->completion); > + for (i = 0; i < VHOST_VDPA_IOTLB_BUCKETS; i++) > + INIT_HLIST_HEAD(&v->as[i]); > > r = cdev_device_add(&v->cdev, &v->dev); > if (r) > goto err; [Severity: High] Is there a use-after-free risk on the error path if cdev_device_add() returns an error? If device_add() fails within cdev_device_add(), the character device might have already been added successfully via cdev_add(), allowing a concurrent open() to succeed. In this scenario, vhost_vdpa_probe() jumps to err and returns an error, causing the driver core to abandon the device bind and free the parent vdpa_device. However, the successfully opened file descriptor pins the vhost_vdpa object and its file operations. When this file descriptor is later closed, vhost_vdpa_release() is called and attempts to reset the device: vhost_vdpa_release() vhost_vdpa_reset() _compat_vdpa_reset() struct vdpa_device *vdpa = v->vdpa; const struct vdpa_config_ops *ops = vdpa->config; Since the parent vdpa_device has already been freed, will this dereference result in a use-after-free? > > - init_completion(&v->completion); > vdpa_set_drvdata(vdpa, v); > > - for (i = 0; i < VHOST_VDPA_IOTLB_BUCKETS; i++) > - INIT_HLIST_HEAD(&v->as[i]); > - > return 0; > > err: -- Sashiko AI review ยท https://sashiko.dev/#/patchset/20261011-fix-null-pointer-in-vhost_vdpa_release-v1-1-43ebc225f...@gmail.com?part=1
