Re: [PATCH] PCI/P2PDMA: Fix use-after-free in pci_p2pdma_add_resource() error path

[Xiang Lei]

On Fri, Jul 17, 2026 at 12:48:12PM +0200, Greg Kroah-Hartman wrote:
> On Fri, Jul 17, 2026 at 05:51:17PM +0800, leixiang wrote:
> > In pci_p2pdma_add_resource(), a devm action is registered to call
> > pci_p2pdma_unmap_mappings() with the 'p2p_pgmap' context. If the subsequent
> > call to gen_pool_add_owner() fails, the code jumps to the 'pages_free'
> > error path.
> > 
> > In this error path, 'p2p_pgmap' is explicitly freed via devm_kfree().
> > However, the previously registered devm action is never removed. This
> > leaves a dangling pointer in the device's devres list. When the device
> > is unbound and devres is cleaning up resources, the unmap action will be
> > called with the already-freed 'p2p_pgmap', resulting in a use-after-free
> > bug.
> > 
> > Fix this by properly calling devm_remove_action() in the error path before
> > freeing 'p2p_pgmap'.
> > 
> > Fixes: 7e9c7ef83d78 ("PCI/P2PDMA: Allow userspace VMA allocations through sysfs")
> > Assisted-by: Antigravity:Gemini [tools]
> > Signed-off-by: leixiang <leixiang@xxxxxxxxxx>
> 
> We need a full name here, not just an email alias.

Hi Greg,

Thanks for pointing that out. I have updated my name and will send a v2 patch shortly.

Best regards,
Xiang Lei