Re: [PATCH v2] misc: pci_endpoint_test: fix use-after-free after device unbind

[Manivannan Sadhasivam]

On Mon, Jun 22, 2026 at 12:52:49PM -0400, Shuangpeng Bai wrote:

[...]

> @@ -1141,10 +1171,15 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd,
>  {
>  	int ret = -EINVAL;
>  	enum pci_barno bar;
> -	struct pci_endpoint_test *test = to_endpoint_test(file->private_data);
> -	struct pci_dev *pdev = test->pdev;
> +	struct pci_endpoint_test *test = file->private_data;

Can't you still use to_endpoint_test()?

> +	struct pci_dev *pdev;
>  
>  	mutex_lock(&test->mutex);
> +	pdev = test->pdev;
> +	if (!pdev) {
> +		ret = -ENODEV;
> +		goto ret;
> +	}
>  
>  	reinit_completion(&test->irq_raised);
>  	test->last_irq = -ENODATA;
> @@ -1206,9 +1241,30 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd,
>  	return ret;
>  }
>  
> +static int pci_endpoint_test_open(struct inode *inode, struct file *file)
> +{
> +	struct miscdevice *miscdev = file->private_data;
> +	struct pci_endpoint_test *test = to_endpoint_test(miscdev);
> +
> +	kref_get(&test->kref);
> +	file->private_data = test;

Same as above. This is not needed.

Rest LGTM!

- Mani

-- 
மணிவண்ணன் சதாசிவம்