- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] fuse: re-lock request before returning from fuse_ref_folio()
by Ran Hongyun 05 Aug '26

05 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit b5befa80fdbe287a98480effed9564712924add5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16564 CVE: CVE-2026-64266 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues. Fix this by locking the request in fuse_ref_folio() before returning. Fixes: c3021629a0d8 ("fuse: support splice() reading from fuse device") Cc: stable(a)vger.kernel.org Signed-off-by: Joanne Koong <joannelkoong(a)gmail.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflicts: fs/fuse/dev.c [394244b24fdd ("fuse: support copying large folios") not merged.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/fuse/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 6d6bf2e7bb9b..9e79f6f989cc 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -972,7 +972,7 @@ static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page, cs->nr_segs++; cs->len = 0; - return 0; + return lock_request(cs->req); } /* -- 2.52.0

2 1

[PATCH OLK-5.10] nfsd: release layout stid on setlease failure
by Ran Hongyun 05 Aug '26

05 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16119 CVE: CVE-2026-53399 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail. A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work. nfsd4_alloc_layout_stateid() nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */ nfsd4_layout_setlease() /* fails */ nfs4_put_stid() nfsd4_free_layout_stateid() delayed_work_pending(&ls->ls_fence_work) /* needs INIT */ nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */ put_nfs4_file() Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp). Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") Cc: stable(a)vger.kernel.org Assisted-by: kres (claude-opus-4-7) Signed-off-by: Chris Mason <clm(a)meta.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs4layouts.c [f52792f484ba ("NFSD: Enforce timeout on layout recall and integrate lease manager fencing" not merged.)] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/nfsd/nfs4layouts.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c index 2673019d30ec..ce6fb5167534 100644 --- a/fs/nfsd/nfs4layouts.c +++ b/fs/nfsd/nfs4layouts.c @@ -242,9 +242,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate, BUG_ON(!ls->ls_file); if (nfsd4_layout_setlease(ls)) { - nfsd_file_put(ls->ls_file); - put_nfs4_file(fp); - kmem_cache_free(nfs4_layout_stateid_cache, ls); + nfs4_put_stid(stp); return NULL; } -- 2.52.0

2 1

[PATCH OLK-5.10 0/5] CVE-2026-63830: preserve sg.copy across SG transforms
by superdcc97＠163.com 05 Aug '26

05 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16159 CVE: CVE-2026-63830 This patchset fixes CVE-2026-63830 for OLK-5.10. The CVE fixes the sk_msg sg.copy bitmap handling across SG transforms. Eric Dumazet (1): skmsg: convert struct sk_msg_sg::copy to a bitmap Yiming Qian (1): net: skmsg: preserve sg.copy across SG transforms Yuqi Xu (1): bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Zijian Zhang (2): bpf, sockmap: Several fixes to bpf_msg_push_data bpf, sockmap: Several fixes to bpf_msg_pop_data include/linux/skmsg.h | 22 +++++---- net/core/filter.c | 101 ++++++++++++++++++++++++++++++------------ net/core/skmsg.c | 2 + net/tls/tls_sw.c | 4 ++ 4 files changed, 92 insertions(+), 37 deletions(-) -- 2.43.0

2 6

openEuler Kernel SIG双周例会
by openEuler conference 05 Aug '26

05 Aug '26

您好！ Kernel 邀请您参加 2026-08-07 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题请直接填报至本会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/987297110 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-08-07 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题请直接填报至本会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/987297110 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10] crypto: qat - protect service table iterations with service_lock
by Cai Xinchen 05 Aug '26

05 Aug '26

From: Ahsan Atta <ahsan.atta(a)intel.com> mainline inclusion from mainline-v7.2-rc1 commit 5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but several functions iterate over the list without holding this lock. A concurrent adf_service_register() or adf_service_unregister() call could modify the list during traversal, leading to list corruption or a use-after-free. Fix this by holding service_lock across all list_for_each_entry() iterations of service_table in adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier(). The lock ordering is safe: callers of the static helpers (adf_dev_up() and adf_dev_down()) acquire state_lock before service_lock, and no event_hld callback or service_lock holder ever acquires state_lock in the reverse order. Cc: stable(a)vger.kernel.org Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework") Signed-off-by: Ahsan Atta <ahsan.atta(a)intel.com> Co-developed-by: Maksim Lukoshkov <maksim.lukoshkov(a)intel.com> Signed-off-by: Maksim Lukoshkov <maksim.lukoshkov(a)intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: drivers/crypto/qat/qat_common/adf_init.c [There is no adf_error_notifier in 5.10 and file is drivers/crypto/qat/qat_common/adf_init.c instead of drivers/crypto/intel/qat/qat_common/adf_init.c] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/crypto/qat/qat_common/adf_init.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c index 5c78433d19d4..59dfde7f761b 100644 --- a/drivers/crypto/qat/qat_common/adf_init.c +++ b/drivers/crypto/qat/qat_common/adf_init.c @@ -116,16 +116,19 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) * This is to facilitate any ordering dependencies between services * prior to starting any of the accelerators. */ + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (service->event_hld(accel_dev, ADF_EVENT_INIT)) { dev_err(&GET_DEV(accel_dev), "Failed to initialise service %s\n", service->name); + mutex_unlock(&service_lock); return -EFAULT; } set_bit(accel_dev->accel_id, service->init_status); } + mutex_unlock(&service_lock); hw_data->enable_error_correction(accel_dev); ret = hw_data->enable_vf2pf_comms(accel_dev); @@ -163,16 +166,19 @@ int adf_dev_start(struct adf_accel_dev *accel_dev) return -EFAULT; } + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (service->event_hld(accel_dev, ADF_EVENT_START)) { dev_err(&GET_DEV(accel_dev), "Failed to start service %s\n", service->name); + mutex_unlock(&service_lock); return -EFAULT; } set_bit(accel_dev->accel_id, service->start_status); } + mutex_unlock(&service_lock); clear_bit(ADF_STATUS_STARTING, &accel_dev->status); set_bit(ADF_STATUS_STARTED, &accel_dev->status); @@ -218,6 +224,7 @@ void adf_dev_stop(struct adf_accel_dev *accel_dev) qat_asym_algs_unregister(); } + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (!test_bit(accel_dev->accel_id, service->start_status)) @@ -230,6 +237,7 @@ void adf_dev_stop(struct adf_accel_dev *accel_dev) clear_bit(accel_dev->accel_id, service->start_status); } } + mutex_unlock(&service_lock); if (wait) msleep(100); @@ -276,6 +284,7 @@ void adf_dev_shutdown(struct adf_accel_dev *accel_dev) &accel_dev->status); } + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (!test_bit(accel_dev->accel_id, service->init_status)) @@ -287,6 +296,7 @@ void adf_dev_shutdown(struct adf_accel_dev *accel_dev) else clear_bit(accel_dev->accel_id, service->init_status); } + mutex_unlock(&service_lock); hw_data->disable_iov(accel_dev); @@ -315,6 +325,7 @@ int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev) struct service_hndl *service; struct list_head *list_itr; + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (service->event_hld(accel_dev, ADF_EVENT_RESTARTING)) @@ -322,6 +333,7 @@ int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev) "Failed to restart service %s.\n", service->name); } + mutex_unlock(&service_lock); return 0; } @@ -330,6 +342,7 @@ int adf_dev_restarted_notify(struct adf_accel_dev *accel_dev) struct service_hndl *service; struct list_head *list_itr; + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (service->event_hld(accel_dev, ADF_EVENT_RESTARTED)) @@ -337,5 +350,6 @@ int adf_dev_restarted_notify(struct adf_accel_dev *accel_dev) "Failed to restart service %s.\n", service->name); } + mutex_unlock(&service_lock); return 0; } -- 2.18.0.huawei.25

2 1

[PATCH OLK-6.6 0/5] CVE-2026-63830: preserve sg.copy across SG transforms
by superdcc97＠163.com 05 Aug '26

05 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16159 CVE: CVE-2026-63830 This patchset fixes CVE-2026-63830 for OLK-5.10. The CVE fixes the sk_msg sg.copy bitmap handling across SG transforms. Eric Dumazet (1): skmsg: convert struct sk_msg_sg::copy to a bitmap Yiming Qian (1): net: skmsg: preserve sg.copy across SG transforms Yuqi Xu (1): bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Zijian Zhang (2): bpf, sockmap: Several fixes to bpf_msg_push_data bpf, sockmap: Several fixes to bpf_msg_pop_data include/linux/skmsg.h | 22 +++++---- net/core/filter.c | 101 ++++++++++++++++++++++++++++++------------ net/core/skmsg.c | 2 + net/tls/tls_sw.c | 4 ++ 4 files changed, 92 insertions(+), 37 deletions(-) -- 2.43.0

2 6

[PATCH OLK-6.6 0/4] CVE-2026-64078: netfilter: x_tables: fix module load and teardown races
by superdcc97＠163.com 05 Aug '26

05 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This series adapts the CVE-2026-64078 netfilter x_tables fixes to OLK-6.6. It contains the first 5 patches from the upstream v3 series sent to netfilter-devel, re-targeted to the OLK-6.6 codebase. Bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16470 CVE: CVE-2026-64078 Florian Westphal (4): netfilter: x_tables: allow initial table replace without emitting audit log message netfilter: x_tables: allocate hook ops while under mutex netfilter: x_tables: add and use xt_unregister_table_pre_exit netfilter: x_tables: add and use xtables_unregister_table_exit include/linux/netfilter/x_tables.h | 4 +- include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - net/ipv4/netfilter/arp_tables.c | 53 +------ net/ipv4/netfilter/arptable_filter.c | 2 +- net/ipv4/netfilter/ip_tables.c | 59 +------- net/ipv4/netfilter/iptable_filter.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/iptable_nat.c | 6 +- net/ipv4/netfilter/iptable_raw.c | 2 +- net/ipv4/netfilter/iptable_security.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 56 +------ net/ipv6/netfilter/ip6table_filter.c | 2 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/ip6table_nat.c | 6 +- net/ipv6/netfilter/ip6table_raw.c | 2 +- net/ipv6/netfilter/ip6table_security.c | 2 +- net/netfilter/x_tables.c | 177 ++++++++++++++++++---- 19 files changed, 193 insertions(+), 189 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
by Zhang Yuwei 05 Aug '26

05 Aug '26

From: Maoyi Xie <maoyixie.tju(a)gmail.com> stable inclusion from stable-v6.6.145 commit 05df59b9a61f7ca66548df079d306c41da23845d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16777 CVE: CVE-2026-64488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd upstream. snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)". len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit. Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway. The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching. Fixes: 15c5ab607045 ("ALSA: snd-usb-caiaq: Add support for Traktor Kontrol S4") Cc: stable(a)vger.kernel.org Signed-off-by: Maoyi Xie <maoyixie.tju(a)gmail.com> Link: https://patch.msgid.link/178176259547.3343534.2724779296835237429@maoyixie.… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- sound/usb/caiaq/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c index 5c70fdf61cc1..2db4d1332df1 100644 --- a/sound/usb/caiaq/input.c +++ b/sound/usb/caiaq/input.c @@ -330,7 +330,7 @@ static void snd_usb_caiaq_tks4_dispatch(struct snd_usb_caiaqdev *cdev, { struct device *dev = caiaqdev_to_dev(cdev); - while (len) { + while (len >= TKS4_MSGBLOCK_SIZE) { unsigned int i, block_id = (buf[0] << 8) | buf[1]; switch (block_id) { -- 2.22.0

2 1

[PATCH OLK-6.6] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
by Zhang Yuwei 05 Aug '26

05 Aug '26

From: Maoyi Xie <maoyixie.tju(a)gmail.com> stable inclusion from stable-v6.6.145 commit 05df59b9a61f7ca66548df079d306c41da23845d category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd upstream. snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)". len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit. Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway. The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching. Fixes: 15c5ab607045 ("ALSA: snd-usb-caiaq: Add support for Traktor Kontrol S4") Cc: stable(a)vger.kernel.org Signed-off-by: Maoyi Xie <maoyixie.tju(a)gmail.com> Link: https://patch.msgid.link/178176259547.3343534.2724779296835237429@maoyixie.… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- sound/usb/caiaq/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c index 5c70fdf61cc1..2db4d1332df1 100644 --- a/sound/usb/caiaq/input.c +++ b/sound/usb/caiaq/input.c @@ -330,7 +330,7 @@ static void snd_usb_caiaq_tks4_dispatch(struct snd_usb_caiaqdev *cdev, { struct device *dev = caiaqdev_to_dev(cdev); - while (len) { + while (len >= TKS4_MSGBLOCK_SIZE) { unsigned int i, block_id = (buf[0] << 8) | buf[1]; switch (block_id) { -- 2.22.0

2 1

[PATCH OLK-6.6] vfio: Remove device debugfs before releasing devres
by Zhang Yuwei 05 Aug '26

05 Aug '26

From: Alex Williamson <alex.williamson(a)nvidia.com> mainline inclusion from mainline-v7.2-rc2 commit dc7fe87de492ea7f33a72b78d26650b75bf37f4f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16762 CVE: CVE-2026-64473 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits for userspace references to drain. Remove the per-device debugfs tree before vfio_device_del(). The debugfs view is diagnostic only, so losing it at the start of unregister is preferable to preserving entries whose backing storage may already have been released. Complete the teardown by clearing the per-device debugfs root after removal. This matches the global debugfs root cleanup and prevents future users from mistaking a removed dentry for a live debugfs tree during the remainder of unregister. Fixes: 2202844e4468 ("vfio/migration: Add debugfs to live migration driver") Reported-by: Sashiko AI Review <sashiko-bot(a)kernel.org> Link: https://lore.kernel.org/r/20260615192725.6A2221F000E9@smtp.kernel.org Cc: stable(a)vger.kernel.org Cc: Longfang Liu <liulongfang(a)huawei.com> Assisted-by: OpenAI Codex:gpt-5 Signed-off-by: Alex Williamson <alex.williamson(a)nvidia.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20260615204717.735302-1-alex.williamson@nvidia.com Signed-off-by: Alex Williamson <alex(a)shazbot.org> Signed-off-by: Yuwei Zhang <zhangyuwei20(a)huawei.com> --- drivers/vfio/debugfs.c | 1 + drivers/vfio/vfio_main.c | 8 +++++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/vfio/debugfs.c b/drivers/vfio/debugfs.c index 298bd866f157..53b678a16d4b 100644 --- a/drivers/vfio/debugfs.c +++ b/drivers/vfio/debugfs.c @@ -78,6 +78,7 @@ void vfio_device_debugfs_init(struct vfio_device *vdev) void vfio_device_debugfs_exit(struct vfio_device *vdev) { debugfs_remove_recursive(vdev->debug_root); + vdev->debug_root = NULL; } void vfio_debugfs_create_root(void) diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c index e9c71005bff5..03d034ece8c9 100644 --- a/drivers/vfio/vfio_main.c +++ b/drivers/vfio/vfio_main.c @@ -350,6 +350,13 @@ void vfio_unregister_group_dev(struct vfio_device *device) */ vfio_device_group_unregister(device); + /* + * Remove debugfs before device_del(), which releases devres. Some + * debugfs entries are created with debugfs_create_devm_seqfile() and + * therefore rely on devres-managed inode private data. + */ + vfio_device_debugfs_exit(device); + /* * Balances vfio_device_add() in register path, also prevents * new device opened by userspace in the cdev path. @@ -379,7 +386,6 @@ void vfio_unregister_group_dev(struct vfio_device *device) } } - vfio_device_debugfs_exit(device); /* Balances vfio_device_set_group in register path */ vfio_device_remove_group(device); } -- 2.22.0

2 1