diff options
| author | Guixin Liu <kanie@linux.alibaba.com> | 2026-09-15 14:01:38 +0800 |
|---|---|---|
| committer | Dave Jiang <dave.jiang@intel.com> | 2026-09-18 08:16:40 -0700 |
| commit | b25af6afd2f26b455108bab03dfeba52378e8dd2 (patch) | |
| tree | 2a8af412febe427dd7743e97e68e78df4216ef63 /tools/perf/scripts/python | |
| parent | a8c458611a7daf67ffd9088088aeb28626135a92 (diff) | |
| download | linux-next-b25af6afd2f26b455108bab03dfeba52378e8dd2.tar.gz linux-next-b25af6afd2f26b455108bab03dfeba52378e8dd2.zip | |
cxl/core: Skip einj_inject creation when devm_add_action_or_reset() fails
cxl_debugfs_create_dport_dir() ignores the devm_add_action_or_reset()
result and creates the einj_inject file below @dir unconditionally.
When the devres allocation fails, remove_debugfs() has already run
before devm_add_action_or_reset() returns, i.e. debugfs_remove() has
released @dir. The subsequent debugfs_create_file() would then use
that dentry as its parent although its final reference was dropped in
the removal and its memory is subject to call_rcu() delayed freeing.
Skip the file creation in that case, consistent with how the rest of
the helper tolerates debugfs failures.
Fixes: 9185b1a3043c ("cxl/core: Fix dport use-after-free via the einj_inject debugfs file")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Li Ming <ming.li@zohomail.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Link: https://patch.msgid.link/20260915060138.2007974-1-kanie@linux.alibaba.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions
