mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
acc516dfa1
There is a potential race condition when two paths try to revoke a
Devres concurrently.
The driver core's devres_release_all() calls Revocable::revoke() via the
release callback, while Devres::drop() calls revoke_nosync() on another
CPU.
The revoker that does not claim the is_available swap returns
immediately, but the revoker that did may still be executing
drop_in_place() on the inner data. This can cause a use-after-free when
the other revoker's caller proceeds to drop adjacent resources that
drop_in_place() still references (e.g., Devres<DmaMappedSgt> racing with
SGTable freeing the backing sg_table and pages).
Fix this by adding a Completion. The release callback signals the
Completion after revoke() finishes, and Devres::drop() waits for it when
it loses the is_available swap. This ensures the wrapped object is fully
torn down before Devres::drop() returns.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/dri-devel/20260612202841.2577C1F000E9@smtp.kernel.org/
Fixes:
|
||
|---|---|---|
| .. | ||
| bindings | ||
| helpers | ||
| kernel | ||
| macros | ||
| pin-init | ||
| proc-macro2 | ||
| quote | ||
| syn | ||
| uapi | ||
| zerocopy | ||
| zerocopy-derive | ||
| .gitignore | ||
| .kunitconfig | ||
| bindgen_parameters | ||
| build_error.rs | ||
| compiler_builtins.rs | ||
| exports.c | ||
| ffi.rs | ||
| Makefile | ||