mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-28 20:24:02 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
bd670e5dfd2b01fd9692f61fa1456434c54026a4
linux/drivers
History
Linfeng Sun  bd670e5dfd vdpa_sim: fix cleanup after worker creation failure 
vdpasim_create() leaves vdpasim->worker as an ERR_PTR when
kthread_run_worker() fails. The error path then drops the device
reference, which releases the partially initialized simulator.

vdpasim_free() unconditionally passes the worker pointer to
kthread_destroy_worker(), so the ERR_PTR is dereferenced and can trigger
a general protection fault.

Store the worker error, clear the pointer, and only clean up the worker
when it was successfully initialized. Also make the release path tolerate
partially initialized objects by guarding virtqueue and IOTLB cleanup,
since the same release path can be reached from other initialization
failures.

I found this bug myself, though the patch was written with AI assistance.

Fixes: 76acfa7bc5 ("vdpa_sim: use kthread worker")
Assisted-by: OpenAI-Codex:GPT-5
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gamil.com>
Message-ID: <20260620100959.2070316-1-slf@hdu.edu.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2026-08-19 06:38:43 -04:00
..
accel
accel/amdxdna: Skip unmapped range in aie2_populate_range()
2026-08-12 23:12:20 -07:00
accessibility
…
acpi
ACPI: CPPC: Skip writes to unsupported performance controls
2026-07-27 15:18:50 +02:00
amba
amba: use generic driver_override infrastructure
2026-05-30 22:25:23 +02:00
android
rust_binder: do not query current thread for all ioctls
2026-07-31 11:00:42 +02:00
ata
Merge tag 'ata-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
2026-08-07 16:32:54 -07:00
atm
atm: remove unused ATM PHY operations
2026-06-16 08:53:53 -07:00
auxdisplay
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
base
regmap: sdw-mbq: don't call an unset readable_reg callback
2026-08-12 18:08:48 +01:00
bcma
…
block
Merge tag 'block-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
2026-08-16 07:00:40 -07:00
bluetooth
Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
2026-07-28 16:13:48 -04:00
bus
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
cache
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
cdrom
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
2026-07-20 21:54:52 -06:00
cdx
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
char
tpm: Make the TPM character devices non-seekable
2026-07-12 12:52:34 -07:00
clk
Merge tag 'qcom-clk-fixes-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-fixes
2026-08-10 11:35:50 -07:00
clocksource
clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer
2026-08-12 17:09:29 +02:00
comedi
comedi: comedi_parport: deal with premature interrupt
2026-07-17 14:50:35 +02:00
connector
…
counter
Merge tag 'counter-fixes-for-7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus
2026-08-06 11:03:41 +02:00
cpufreq
cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
2026-07-27 16:58:45 +02:00
cpuidle
cpuidle: Allow exit latency to exceed target residency
2026-06-23 14:00:29 +02:00
crypto
Merge tag 'v7.2-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2026-08-10 08:36:22 -07:00
cxl
Merge branch 'for-7.2/cxl-type2-attach-region' into cxl-for-next
2026-06-12 13:47:53 -07:00
dax
Merge tag 'mm-stable-2026-06-18-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-06-19 10:14:34 -07:00
dca
…
devfreq
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
dibs
net/dibs: Correct freeing of dmb_clientid_arr
2026-08-12 17:08:05 -07:00
dio
…
dma
Merge tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
2026-08-02 09:19:40 -07:00
dma-buf
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
2026-07-10 16:26:39 -07:00
dpll
dpll: use pin owner's dpll ref for pin-level attribute reporting
2026-07-24 16:15:19 -07:00
edac
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
eisa
…
extcon
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
firewire
firewire: ohci: fix NULL pointer dereference in ar_context_release
2026-08-13 21:02:23 +09:00
firmware
Merge tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-07-26 10:47:58 -07:00
fpga
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
fsi
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
fwctl
…
gnss
…
gpib
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
gpio
gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
2026-08-10 12:49:04 +02:00
gpu
Merge tag 'drm-xe-fixes-2026-08-13' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes
2026-08-14 15:41:40 +10:00
greybus
…
hid
Merge tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-07-12 12:37:28 -07:00
hsi
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
hte
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
hv
mshv_vtl: bounds-check cpu index in vtl mmap fault handler
2026-07-31 20:02:04 +00:00
hwmon
Merge tag 'hwmon-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
2026-08-07 17:14:05 -07:00
hwspinlock
hwspinlock: qcom: avoid uninitialized struct members
2026-06-08 21:51:12 -05:00
hwtracing
intel_th: fix MSC output device reference leak
2026-07-17 14:52:08 +02:00
i2c
Revert "i2c: designware: defer probe if child GpioInt controllers are not bound"
2026-08-16 10:40:14 -07:00
i3c
i3c: mipi-i3c-hci: Use named initializers for platform_device_id's .driver_data
2026-06-16 23:19:45 +02:00
idle
Merge tag 'x86-msr-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
2026-06-15 15:08:14 +05:30
iio
Merge tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2026-07-12 12:37:28 -07:00
infiniband
bnge/bng_re: fix ring ID widths
2026-07-23 10:24:12 -07:00
input
Merge tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
2026-08-14 21:51:26 -07:00
interconnect
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
iommu
Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd
2026-07-30 15:12:31 -07:00
ipack
…
irqchip
Merge tag 'irq-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-07-05 05:29:41 -10:00
leds
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
macintosh
sched/cputime: Remove superfluous and error prone kcpustat_field() parameter
2026-06-02 21:27:25 +02:00
mailbox
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
mcb
…
md
dm thin metadata: fix superblock refcount leak on snapshot shadow failure
2026-07-11 15:18:51 +02:00
media
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
memory
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
memstick
memstick: ms_block: reject a card that reports too many blocks
2026-07-06 17:09:30 +02:00
message
…
mfd
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
misc
mei: pull kvfree out of spinlock
2026-07-31 13:28:05 +02:00
mmc
mmc: loongson2: Fix sg iteration in data reorder functions
2026-08-04 15:39:11 +02:00
most
…
mtd
Merge tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
2026-07-17 09:30:17 -07:00
mux
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
net
wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
2026-08-16 11:07:18 -07:00
nfc
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
ntb
Merge tag 'ntb-7.2' of https://github.com/jonmason/ntb
2026-06-28 07:46:12 -07:00
nubus
…
nvdimm
Merge tag 'libnvdimm-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2026-06-18 16:27:58 -07:00
nvme
Merge tag 'block-7.2-20260625' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
2026-06-25 09:56:47 -07:00
nvmem
nvmem: layouts: Add fixed-layout driver
2026-07-31 11:00:13 +02:00
of
Merge tag 'devicetree-fixes-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
2026-07-31 14:03:19 -07:00
opp
…
parisc
…
parport
…
pci
Merge tag 'pci-v7.2-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
2026-07-31 10:11:52 -07:00
pcmcia
…
peci
…
perf
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
phy
Merge tag 'phy-fixes-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
2026-08-02 09:16:32 -07:00
pinctrl
Merge tag 'pinctrl-qcom-fixes-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes
2026-08-03 09:54:28 +02:00
platform
Merge tag 'platform-drivers-x86-v7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
2026-07-28 13:45:01 -07:00
pmdomain
pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()
2026-08-12 11:09:12 +02:00
pnp
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
power
Merge tag 'for-v7.2-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply
2026-07-30 16:50:17 -07:00
powercap
powercap: intel_rapl: Use sysfs_emit() in cpumask_show()
2026-06-01 19:55:32 +02:00
pps
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
ps3
…
ptp
ptp: ocp: Fix board ID over-read
2026-08-06 09:15:40 -07:00
pwm
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
rapidio
Merge tag 'mm-nonmm-stable-2026-06-21-10-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-06-21 13:20:19 -07:00
ras
Merge tag 'edac_updates_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/ras/ras
2026-06-16 05:31:01 +05:30
regulator
regulator: fp9931: Fix VPOS/VNEG voltage selector table
2026-07-31 18:40:28 +01:00
remoteproc
remoteproc: qcom: pas: Drop start/stop completion from struct qcom_pas
2026-06-08 21:53:51 -05:00
resctrl
arm_mpam: guard MBWU state before adding it to garbage
2026-07-16 14:46:27 +01:00
reset
Merge tag 'reset-fixes-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/pza/linux into arm/fixes
2026-07-10 14:15:39 +02:00
rpmsg
Merge tag 'rpmsg-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux
2026-06-20 23:31:15 -07:00
rtc
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
s390
Merge tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
2026-08-09 06:31:16 -07:00
sbus
…
scsi
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2026-08-12 08:03:31 -07:00
sh
…
siox
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
slimbus
slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
2026-06-05 17:19:51 +02:00
soc
Merge tag 'aspeed-7.2-driver-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes
2026-08-04 10:57:08 +02:00
soundwire
ASoC/soundwire: Intel: reset the PCMSyCM registers in hda_sdw_bpt_close
2026-07-31 13:23:10 +01:00
spi
spi: virtio: mark device ready before registering the controller
2026-08-13 17:34:01 +01:00
spmi
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
ssb
…
staging
staging: rtl8723bs: validate monitor transmit frame lengths
2026-07-28 09:44:42 +02:00
target
scsi: target: Clear cmd_cnt when initial counter enrollment fails
2026-07-28 21:52:09 -04:00
tc
…
tee
optee: ffa: Add NULL check in optee_ffa_lend_protmem
2026-06-29 08:04:45 +02:00
thermal
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
2026-08-05 13:25:55 +02:00
thunderbolt
thunderbolt: Initialize ->domain_released completion before it is being used
2026-07-30 06:47:32 +02:00
tty
serial: amba-pl011: synchronize DMA teardown
2026-08-03 16:31:22 +02:00
ufs
scsi: core: pair EH runtime PM get and put
2026-08-07 11:00:49 -04:00
uio
uio_hv_generic: Bind to FCopy device by default
2026-07-17 14:50:09 +02:00
usb
usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
2026-08-04 10:54:57 +02:00
vdpa
vdpa_sim: fix cleanup after worker creation failure
2026-08-19 06:38:43 -04:00
vfio
vfio/pci: Expose latched module parameter policy in debugfs
2026-06-29 14:26:31 -06:00
vhost
vhost-scsi: reject feature changes after endpoint
2026-08-03 23:08:15 -04:00
video
fbdev: bitblit: bound-check glyph index in bit_cursor()
2026-08-08 08:08:58 +02:00
virt
drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()
2026-07-17 18:49:12 +01:00
virtio
virtio_balloon: disable indirect descriptors
2026-08-19 06:38:43 -04:00
w1
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
2026-07-03 07:38:17 +02:00
watchdog
watchdog: at91sam9_wdt: prevent timer rearm during teardown
2026-08-06 14:23:55 -07:00
xen
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
2026-07-18 12:36:19 -07:00
zorro
…
Kconfig
…
Makefile
…