hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/21064 -------------------------------- mpam_debugfs_setup() creates mpam/class.N under the mpam debugfs root, with files whose private data point at &class->props, &class->nrdy_usec and &class->affinity, and mpam/class.N/comp.M below it. class.N sits beside msc.N, not below it. mpam_msc_destroy() removes the MSC's debugfs subtree and stops there. mpam_comp_destroy() and mpam_class_destroy() then kfree() the component and the class, and the class.N and class.N/comp.M dentries stay in debugfs pointing at the freed memory. After the last MSC of a class is unbound, /sys/kernel/debug/mpam still lists class.N, and reading class.N/affinity dereferences the freed struct mpam_class. Unbinding every mpam_msc on the 8-CPU topology leaves the three class.N directories listed under /sys/kernel/debug/mpam; the same listing is empty once the destructors remove their subtrees. Remove the class and component subtrees in mpam_class_destroy() and mpam_comp_destroy() before kfree(). debugfs_remove_recursive() waits for readers that are already inside the files to leave, which is the order the warning-free teardown needs; the removal cannot follow the free. Only systems that enumerate the driver's debugfs entries and unbind an MSC are affected. The unbind path is reachable through /sys/bus/platform/drivers/mpam_msc/unbind. Fixes: cb17dafb1c6f ("arm64/mpam: Add debugfs entries to show the MSC/RIS the driver discovered") Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> --- drivers/platform/mpam/mpam_devices.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index e934fdb91414..fc9ba63afe82 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -339,6 +339,15 @@ static void mpam_class_destroy(struct mpam_class *class) { lockdep_assert_held(&mpam_list_lock); + /* + * class.N is a sibling of msc.N in debugfs, so removing the MSC's + * subtree does not remove it. The files below it point straight at + * class->props and class->affinity: remove them, and wait for + * readers to drain, before the class is freed. + */ + debugfs_remove_recursive(class->debugfs); + class->debugfs = NULL; + list_del_rcu(&class->classes_list); synchronize_srcu(&mpam_srcu); kfree(class); @@ -350,6 +359,9 @@ static void mpam_comp_destroy(struct mpam_component *comp) lockdep_assert_held(&mpam_list_lock); + debugfs_remove_recursive(comp->debugfs); + comp->debugfs = NULL; + list_del_rcu(&comp->class_list); synchronize_srcu(&mpam_srcu); kfree(comp); -- 2.34.1