Re: [PATCH] dmaengine: idxd: Fix use-after-free in idxd_remove

[Vinicius Costa Gomes]

Hi Ziyou,

Ziyou Wang <ziyou.dev@xxxxxxxxx> writes:

> Hi Vinod,
>
> Gentle ping on this patch.
>
> This fixes a use-after-free bug that can be triggered when unbinding
> the idxd driver, which results in a kernel crash. The fix has been
> tested on real hardware (Lenovo WenTian WR5220 G5) and verified with
> KASAN.
>
> The issue is critical as it causes general protection fault during
> driver unbind. The fix is straightforward - taking reference counts
> on wq/engine/group conf_dev before unregistering to prevent premature
> freeing.
>
> Please let me know if any changes are needed or if you need more
> information.
>

It looks very similar to the issue that

https://lore.kernel.org/all/20260415095030.42183-1-kanie@xxxxxxxxxxxxxxxxx/

tries to fix, can you confirm that it solves the issue you are seeing?


Cheers,
-- 
Vinicius