github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
bd670e5dfd
linux/drivers
History
Linfeng Sun  bd670e5dfd vdpa_sim: fix cleanup after worker creation failure 
vdpasim_create() leaves vdpasim->worker as an ERR_PTR when
kthread_run_worker() fails. The error path then drops the device
reference, which releases the partially initialized simulator.

vdpasim_free() unconditionally passes the worker pointer to
kthread_destroy_worker(), so the ERR_PTR is dereferenced and can trigger
a general protection fault.

Store the worker error, clear the pointer, and only clean up the worker
when it was successfully initialized. Also make the release path tolerate
partially initialized objects by guarding virtqueue and IOTLB cleanup,
since the same release path can be reached from other initialization
failures.

I found this bug myself, though the patch was written with AI assistance.

Fixes: 76acfa7bc5 ("vdpa_sim: use kthread worker")
Assisted-by: OpenAI-Codex:GPT-5
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gamil.com>
Message-ID: <20260620100959.2070316-1-slf@hdu.edu.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2026-08-19 06:38:43 -04:00
..
accel accel/amdxdna: Skip unmapped range in aie2_populate_range() 2026-08-12 23:12:20 -07:00
accessibility
acpi ACPI: CPPC: Skip writes to unsupported performance controls 2026-07-27 15:18:50 +02:00
amba amba: use generic driver_override infrastructure 2026-05-30 22:25:23 +02:00
android rust_binder: do not query current thread for all ioctls 2026-07-31 11:00:42 +02:00
ata ata fixes for 7.2-rc7 2026-08-07 16:32:54 -07:00
atm atm: remove unused ATM PHY operations 2026-06-16 08:53:53 -07:00
auxdisplay Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
base regmap: sdw-mbq: don't call an unset readable_reg callback 2026-08-12 18:08:48 +01:00
bcma
block block-7.2-20260815 2026-08-16 07:00:40 -07:00
bluetooth Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() 2026-07-28 16:13:48 -04:00
bus Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cache Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cdrom cdrom: fix stack out-of-bounds read in CDROMVOLCTRL 2026-07-20 21:54:52 -06:00
cdx Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
char tpm: Make the TPM character devices non-seekable 2026-07-12 12:52:34 -07:00
clk Qualcomm clock fixes for v7.2 2026-08-10 11:35:50 -07:00
clocksource clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer 2026-08-12 17:09:29 +02:00
comedi comedi: comedi_parport: deal with premature interrupt 2026-07-17 14:50:35 +02:00
connector
counter Counter fixes for 7.2 2026-08-06 11:03:41 +02:00
cpufreq cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() 2026-07-27 16:58:45 +02:00
cpuidle cpuidle: Allow exit latency to exceed target residency 2026-06-23 14:00:29 +02:00
crypto This push contains the following changes: 2026-08-10 08:36:22 -07:00
cxl Merge branch 'for-7.2/cxl-type2-attach-region' into cxl-for-next 2026-06-12 13:47:53 -07:00
dax mm.git review status for mm-hotfixes-stable..mm-stable 2026-06-19 10:14:34 -07:00
dca
devfreq Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
dibs net/dibs: Correct freeing of dmb_clientid_arr 2026-08-12 17:08:05 -07:00
dio
dma dmaengine fixes for v7.2 2026-08-02 09:19:40 -07:00
dma-buf udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() 2026-07-10 16:26:39 -07:00
dpll dpll: use pin owner's dpll ref for pin-level attribute reporting 2026-07-24 16:15:19 -07:00
edac Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
eisa
extcon Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
firewire firewire: ohci: fix NULL pointer dereference in ar_context_release 2026-08-13 21:02:23 +09:00
firmware Char/Misc driver fixes for 7.2-rc5 2026-07-26 10:47:58 -07:00
fpga Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fsi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fwctl
gnss
gpib Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
gpio gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind 2026-08-10 12:49:04 +02:00
gpu Driver Changes: 2026-08-14 15:41:40 +10:00
greybus
hid Android/IIO bugfixes for 7.2-rc3 2026-07-12 12:37:28 -07:00
hsi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hte Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hv mshv_vtl: bounds-check cpu index in vtl mmap fault handler 2026-07-31 20:02:04 +00:00
hwmon hwmon fixes for v7.2-rc7 2026-08-07 17:14:05 -07:00
hwspinlock hwspinlock: qcom: avoid uninitialized struct members 2026-06-08 21:51:12 -05:00
hwtracing intel_th: fix MSC output device reference leak 2026-07-17 14:52:08 +02:00
i2c Revert "i2c: designware: defer probe if child GpioInt controllers are not bound" 2026-08-16 10:40:14 -07:00
i3c i3c: mipi-i3c-hci: Use named initializers for platform_device_id's .driver_data 2026-06-16 23:19:45 +02:00
idle x86/msr updates for v7.2: 2026-06-15 15:08:14 +05:30
iio Android/IIO bugfixes for 7.2-rc3 2026-07-12 12:37:28 -07:00
infiniband bnge/bng_re: fix ring ID widths 2026-07-23 10:24:12 -07:00
input Input updates for v7.2-rc7 2026-08-14 21:51:26 -07:00
interconnect Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
iommu iommufd v7.2 first rc pull request 2026-07-30 15:12:31 -07:00
ipack
irqchip Misc irqchip driver fixes: 2026-07-05 05:29:41 -10:00
leds Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
macintosh sched/cputime: Remove superfluous and error prone kcpustat_field() parameter 2026-06-02 21:27:25 +02:00
mailbox Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
mcb
md dm thin metadata: fix superblock refcount leak on snapshot shadow failure 2026-07-11 15:18:51 +02:00
media Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
memory Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
memstick memstick: ms_block: reject a card that reports too many blocks 2026-07-06 17:09:30 +02:00
message
mfd Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
misc mei: pull kvfree out of spinlock 2026-07-31 13:28:05 +02:00
mmc mmc: loongson2: Fix sg iteration in data reorder functions 2026-08-04 15:39:11 +02:00
most
mtd Among the most important fixes that we have here, there are: 2026-07-17 09:30:17 -07:00
mux Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
net wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock 2026-08-16 11:07:18 -07:00
nfc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ntb NTB updates include an EPF bug fix to prevent an invalid unmap during 2026-06-28 07:46:12 -07:00
nubus
nvdimm Updates for the 7.2 release 2026-06-18 16:27:58 -07:00
nvme block-7.2-20260625 2026-06-25 09:56:47 -07:00
nvmem nvmem: layouts: Add fixed-layout driver 2026-07-31 11:00:13 +02:00
of Devicetree fixes for v7.2, part 1: 2026-07-31 14:03:19 -07:00
opp
parisc
parport
pci pci-v7.2-fixes-1 2026-07-31 10:11:52 -07:00
pcmcia
peci
perf Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
phy phy fixes for 7.2 2026-08-02 09:16:32 -07:00
pinctrl Qualcomm pin control fixes for v7.2-rc6 2026-08-03 09:54:28 +02:00
platform platform-drivers-x86 for v7.2-4 2026-07-28 13:45:01 -07:00
pmdomain pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() 2026-08-12 11:09:12 +02:00
pnp Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
power Power Supply Fixes for 7.2 cycle 2026-07-30 16:50:17 -07:00
powercap powercap: intel_rapl: Use sysfs_emit() in cpumask_show() 2026-06-01 19:55:32 +02:00
pps Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ps3
ptp ptp: ocp: Fix board ID over-read 2026-08-06 09:15:40 -07:00
pwm Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rapidio mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
ras - Fix a malformed Kconfig default for the AMD Address Translation Library 2026-06-16 05:31:01 +05:30
regulator regulator: fp9931: Fix VPOS/VNEG voltage selector table 2026-07-31 18:40:28 +01:00
remoteproc remoteproc: qcom: pas: Drop start/stop completion from struct qcom_pas 2026-06-08 21:53:51 -05:00
resctrl arm_mpam: guard MBWU state before adding it to garbage 2026-07-16 14:46:27 +01:00
reset Reset controller fixes for v7.2 2026-07-10 14:15:39 +02:00
rpmsg rpmsg update for v7.2 2026-06-20 23:31:15 -07:00
rtc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
s390 s390 updates for 7.2-rc7 2026-08-09 06:31:16 -07:00
sbus
scsi SCSI fixes on 20260812 2026-08-12 08:03:31 -07:00
sh
siox Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
slimbus slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock 2026-06-05 17:19:51 +02:00
soc aspeed: First batch of driver fixes for 7.2 2026-08-04 10:57:08 +02:00
soundwire ASoC/soundwire: Intel: reset the PCMSyCM registers in hda_sdw_bpt_close 2026-07-31 13:23:10 +01:00
spi spi: virtio: mark device ready before registering the controller 2026-08-13 17:34:01 +01:00
spmi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ssb
staging staging: rtl8723bs: validate monitor transmit frame lengths 2026-07-28 09:44:42 +02:00
target scsi: target: Clear cmd_cnt when initial counter enrollment fails 2026-07-28 21:52:09 -04:00
tc
tee optee: ffa: Add NULL check in optee_ffa_lend_protmem 2026-06-29 08:04:45 +02:00
thermal Revert "thermal/drivers/hwmon: Cleanup coding style a bit" 2026-08-05 13:25:55 +02:00
thunderbolt thunderbolt: Initialize ->domain_released completion before it is being used 2026-07-30 06:47:32 +02:00
tty serial: amba-pl011: synchronize DMA teardown 2026-08-03 16:31:22 +02:00
ufs scsi: core: pair EH runtime PM get and put 2026-08-07 11:00:49 -04:00
uio uio_hv_generic: Bind to FCopy device by default 2026-07-17 14:50:09 +02:00
usb usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask 2026-08-04 10:54:57 +02:00
vdpa vdpa_sim: fix cleanup after worker creation failure 2026-08-19 06:38:43 -04:00
vfio vfio/pci: Expose latched module parameter policy in debugfs 2026-06-29 14:26:31 -06:00
vhost vhost-scsi: reject feature changes after endpoint 2026-08-03 23:08:15 -04:00
video fbdev: bitblit: bound-check glyph index in bit_cursor() 2026-08-08 08:08:58 +02:00
virt drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() 2026-07-17 18:49:12 +01:00
virtio virtio_balloon: disable indirect descriptors 2026-08-19 06:38:43 -04:00
w1 Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
watchdog watchdog: at91sam9_wdt: prevent timer rearm during teardown 2026-08-06 14:23:55 -07:00
xen SCSI fixes on 20260718 2026-07-18 12:36:19 -07:00
zorro
Kconfig
Makefile