From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BED6D42DFF1 for ; Fri, 15 May 2026 09:18:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778836734; cv=none; b=TKwQQKAby2Z2nyohrrBQ/d1qulKvK+pDUWoAE8G45kJ04+1zeWa9BnDHhh3NfzvuBTEEwiH9j+pZ8THllUTJWq+QPyGTp07XZUvsZAchFZO1bhLE+Lzt7zCFlIvmtWcUg/C2meDHYUlOdqNGmpSDLFOBJTHTLle5Hf0zpOnAHPM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778836734; c=relaxed/simple; bh=ycQnYxHn2pvNdObysxxGIIEYZtwaNIIQlS3L0eWUg0A=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=skGQM8FSMm88KjNnLgIckQIOxcrGPhb0JMQDi+uz+EHoXVdeacQaKqFvWaKYpRhZMQdz2pgX4DLtGj8iJ+UU3ln6eNWTppvdJVAmdF2F/TdS/MF4iT49WxZCrm7VzEpnKtQzv2m42tjn7WbKyLzwH5lT84HZ2dirZxP1IVzwew0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iV7QZaaK; arc=none smtp.client-ip=209.85.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iV7QZaaK" Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-48a7fe4f40bso102372285e9.0 for ; Fri, 15 May 2026 02:18:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778836731; x=1779441531; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=ycQnYxHn2pvNdObysxxGIIEYZtwaNIIQlS3L0eWUg0A=; b=iV7QZaaKszkPJsNkCf+NrIixplR+U84K4WxxDlDlYeVFRdkjNHfudJFRJA5f6IuXhp MyNdkcg+7t5pEaG2JE5QAkzxc8VZnCa996hUv9lhhpjVBOA5FZqH3TE0pxOaoLueXFr7 zyiLKGjUpeNF9PkMvJH/7y7q1Thkey8rROJvG/HVMaRvQRNsNhR9QcwOqzJaa7QhKERh +e7gyoEhikqP3+p2gQ4Ed8LUehlSMheFcXijkWiODvrVSU6CoPBQSQZrc1FJWSVdFu0l To5Zy8H33ozTlX/PoaK40vsbW1rmc/SXIJ2QrAIa8orq0LUtDPv7rzZYkChMO2s/XBoE 63pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778836731; x=1779441531; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=ycQnYxHn2pvNdObysxxGIIEYZtwaNIIQlS3L0eWUg0A=; b=ddVdA4RFDhUFTpd5g4u/Zs5RJ68Na4RVqPlsUoAefCWmQ9jhKlpYtgg7d6qt4gYJva 4sjUu+gLzRLLbNhBB9tYNKuQainhtYP3EoCuMhzF9XC3WA9aCDPx2mImSuLJgDsAdTiv qZxpX58Z68huA/+9kNOl3GYRbQ+kGAyrw7eOWNryaRzeKgvPISpTxNVVLWyFKfrEWXzR UjKyRnatUfEMHZPQQCU6Ywnaoh6OWelozKbRXYW+xd2NuaIg8MlTbMJwm58l1TAvy1Wg /KqaRZaZKpBH4AXfYYzE7yCxUupBb66N+d+AbDGAYCdoJ5Jq8AINSM+S7FXNXlHWEUkg q5DQ== X-Gm-Message-State: AOJu0YyYRe6Fee+Tu5JgxSX6dBFF5jL4+LAIbFys0pZ1Pndaz5AruN5O 4SOXJY8hbORBFQeuvwbQRP/fZRqQ8/UzRCDJ+yz5y/jmEuR/ElrDduSlWTyKLw== X-Gm-Gg: Acq92OFGYgNyU51ilhp1zXBRWSqJXL2t18azeZw67zoE2+l5fZlY/u3+7/OG5sEQTpn rJjnLJ8lHDPDO75OsldoIuL1Gv/Ah+Fdlj0PvWq7qWcXUAREOP18bM5kdZnjtoNOqVX9vQ4Sg67 sZ3pbTS4XgbEeSZ34G/KJCQtV1aRgzZsGcecNLyUokaJzDyVWoJF0MBjxnZmfk1NfpdVhGzjoID yDYawOF6l02o/PPjNsP3HGAs6h9aK86/UqZ6r/h2xIdeJSqnZFG1FQpLb5NXW9CGVT3tirbulhC cTi2Xu+CbRKaRWBI8vid+JmKi8sIJES9OiBLbHd9y63LvgnkG65Cv3pvbmZFalb0/LvRY8ubepl eSFw1xFQcdgawb78QDJQRBlv04eAAOya72jLXd17BNJtm5R5V63Y+lHFPb4SgBGU55wyKV8eQcJ rOCJPKOp82z2l5u+6Z2uqP8NMPa/UDz1VAYbovW8Z5jsCGCdwx8gypdNYWzBz8vshe/+/Ol1Ixg UyOhisyLombZBXVhrGVY6asS2TTQ0pxIoKdmXldKT4beQCU1t0mymOa X-Received: by 2002:a05:6000:4203:b0:43d:77c6:be78 with SMTP id ffacd0b85a97d-45e5c612ff1mr3916953f8f.39.1778836731008; Fri, 15 May 2026 02:18:51 -0700 (PDT) Received: from ?IPV6:2003:f6:f70c:c00:a08b:a7bc:26af:7b17? (p200300f6f70c0c00a08ba7bc26af7b17.dip0.t-ipconnect.de. [2003:f6:f70c:c00:a08b:a7bc:26af:7b17]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-45da0fe13b4sm13047579f8f.28.2026.05.15.02.18.50 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 15 May 2026 02:18:50 -0700 (PDT) Message-ID: <7504d205-a1fe-4514-aff4-a883cd290dbe@gmail.com> Date: Fri, 15 May 2026 11:18:50 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mcb: fix KASAN bug slab-use-after-free while removing mcb-pci To: Jose Javier Rodriguez Barbarin Cc: linux-kernel@vger.kernel.org, Filip Jensen References: <20260427134608.37474-1-dev-josejavier.rodriguez@duagon.com> Content-Language: en-US From: Johannes Thumshirn In-Reply-To: <20260427134608.37474-1-dev-josejavier.rodriguez@duagon.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 4/27/26 3:46 PM, Jose Javier Rodriguez Barbarin wrote: > Fix KASAN bug reported when removing mcb-pci module. > > slab-use-after-free in mcb_release_bus drivers/mcb/mcb-core.c:73 > Read of size 8 at addr ffff888101e52060 by task modprobe/4993 > > mcb_release_bus+0x3e/0x40 drivers/mcb/mcb-core.c:73 > mcb_pci_remove+0x4e/0x70 [mcb_pci] > pci_device_remove+0xaa/0x1d0 drivers/pci/pci-driver.c:503 > ... > > The bug is caused by an incorrect usage of bus_for_each_dev(), thus > if there are more than one pci mcb board, __mcb_bus_add_devices() > adds all bus devices recursively, so for mcb:0 it adds its devices > and for mcb:1 it adds the devices of mcb:0 and mcb:1. > > The same behaviour is observed on __mcb_devices_unregister(). So > when unregistering process happens, for mcb:1, all devices are unregisted, > even the devices of mcb:0 so when mcb:0 tries to unregister its > devices, slab-use-after-free happens. > > To fix that, just register/unregister the devices on the correct bus. > Additonally, with this change, mcb_bus have to be explicitly unregistered. > > Reviewed-by: Filip Jensen > Signed-off-by: Jose Javier Rodriguez Barbarin Looks good, thanks.