Re: [PATCH] PCI/P2PDMA: Fix use-after-free in pci_p2pdma_add_resource() error path

[Greg Kroah-Hartman]

On Fri, Jul 17, 2026 at 05:51:17PM +0800, leixiang wrote:
> In pci_p2pdma_add_resource(), a devm action is registered to call
> pci_p2pdma_unmap_mappings() with the 'p2p_pgmap' context. If the subsequent
> call to gen_pool_add_owner() fails, the code jumps to the 'pages_free'
> error path.
> 
> In this error path, 'p2p_pgmap' is explicitly freed via devm_kfree().
> However, the previously registered devm action is never removed. This
> leaves a dangling pointer in the device's devres list. When the device
> is unbound and devres is cleaning up resources, the unmap action will be
> called with the already-freed 'p2p_pgmap', resulting in a use-after-free
> bug.
> 
> Fix this by properly calling devm_remove_action() in the error path before
> freeing 'p2p_pgmap'.
> 
> Fixes: 7e9c7ef83d78 ("PCI/P2PDMA: Allow userspace VMA allocations through sysfs")
> Assisted-by: Antigravity:Gemini [tools]
> Signed-off-by: leixiang <leixiang@xxxxxxxxxx>

We need a full name here, not just an email alias.

thanks,

greg k-h