hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9840 ------------------ mpam_msc_drv_remove() calls mpam_msc_destroy() before synchronize_srcu(). mpam_msc_destroy() frees the per-RIS state (via mpam_ris_destroy()), but readers that entered a read-side critical section by locking mpam_srcu may still hold pointers into that memory, and the SRCU grace period is only waited for afterwards. This leaves a window for an RCU-side use-after-free after the MSC is unbound. Call mpam_msc_destroy() only after synchronize_srcu() so all read-side critical sections have completed before the RIS state is freed. Fixes: 848cefee5a21 ("arm_mpam: Add the class and component structures for ris firmware described") Signed-off-by: Zeng Heng <zengheng4@huawei.com> --- drivers/platform/mpam/mpam_devices.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 73f105072ff43..2f44e1cfbd1a8 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -2710,8 +2710,8 @@ static int mpam_msc_drv_remove(struct platform_device *pdev) mpam_num_msc--; platform_set_drvdata(pdev, NULL); list_del_rcu(&msc->glbl_list); - mpam_msc_destroy(msc); synchronize_srcu(&mpam_srcu); + mpam_msc_destroy(msc); mutex_unlock(&mpam_list_lock); return 0; -- 2.43.0