Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2224288/?format=api
{ "id": 2224288, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2224288/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ltp/patch/20260417022949.2881047-1-zhanghongtao35@huawei.com/", "project": { "id": 59, "url": "http://patchwork.ozlabs.org/api/1.2/projects/59/?format=api", "name": "Linux Test Project development", "link_name": "ltp", "list_id": "ltp.lists.linux.it", "list_email": "ltp@lists.linux.it", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260417022949.2881047-1-zhanghongtao35@huawei.com>", "list_archive_url": null, "date": "2026-04-17T02:29:49", "name": "tpci: Unbind/rebind driver in test_assign_resources()", "commit_ref": null, "pull_url": null, "state": "needs-review-ack", "archived": false, "hash": "c9d6e3a7a2c762979bcd256e9fe3e1bdcec3c42e", "submitter": { "id": 93174, "url": "http://patchwork.ozlabs.org/api/1.2/people/93174/?format=api", "name": "Hongtao Zhang", "email": "zhanghongtao35@huawei.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ltp/patch/20260417022949.2881047-1-zhanghongtao35@huawei.com/mbox/", "series": [ { "id": 500279, "url": "http://patchwork.ozlabs.org/api/1.2/series/500279/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ltp/list/?series=500279", "date": "2026-04-17T02:29:49", "name": "tpci: Unbind/rebind driver in test_assign_resources()", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500279/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2224288/comments/", "check": "success", "checks": "http://patchwork.ozlabs.org/api/patches/2224288/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "ltp@lists.linux.it" ], "Delivered-To": [ "patchwork-incoming@legolas.ozlabs.org", "ltp@picard.linux.it" ], "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=lists.linux.it header.i=@lists.linux.it\n header.a=rsa-sha256 header.s=picard header.b=YYRYruwH;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n unprotected) header.d=huawei.com header.i=@huawei.com header.a=rsa-sha256\n header.s=dkim header.b=Eryvz9kG;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it\n (client-ip=2001:1418:10:5::2; helo=picard.linux.it;\n envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from picard.linux.it (picard.linux.it [IPv6:2001:1418:10:5::2])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxpWg3YGHz1yDF\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 18:51:11 +1000 (AEST)", "from picard.linux.it (localhost [IPv6:::1])\n\tby picard.linux.it (Postfix) with ESMTP id 75F6D3E2FF5\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 10:51:09 +0200 (CEST)", "from in-5.smtp.seeweb.it (in-5.smtp.seeweb.it\n [IPv6:2001:4b78:1:20::5])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature ECDSA (secp384r1))\n (No client certificate requested)\n by picard.linux.it (Postfix) with ESMTPS id 100993C22A5\n for <ltp@lists.linux.it>; Fri, 17 Apr 2026 04:06:49 +0200 (CEST)", "from canpmsgout07.his.huawei.com (canpmsgout07.his.huawei.com\n [113.46.200.222])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by in-5.smtp.seeweb.it (Postfix) with ESMTPS id 931FB6006F0\n for <ltp@lists.linux.it>; Fri, 17 Apr 2026 04:06:47 +0200 (CEST)", "from mail.maildlp.com (unknown [172.19.163.214])\n by canpmsgout07.his.huawei.com (SkyGuard) with ESMTPS id 4fxdPg45mTzLlYX;\n Fri, 17 Apr 2026 10:00:23 +0800 (CST)", "from dggpemr500010.china.huawei.com (unknown [7.185.36.210])\n by mail.maildlp.com (Postfix) with ESMTPS id 3154F40561;\n Fri, 17 Apr 2026 10:06:42 +0800 (CST)", "from huawei.com (10.50.85.180) by dggpemr500010.china.huawei.com\n (7.185.36.210) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Fri, 17 Apr\n 2026 10:06:41 +0800" ], "DKIM-Signature": [ "v=1; a=rsa-sha256; c=relaxed/simple; d=lists.linux.it;\n i=@lists.linux.it; q=dns/txt; s=picard; t=1776415869; h=to : date :\n message-id : mime-version : subject : list-id : list-unsubscribe :\n list-archive : list-post : list-help : list-subscribe : from :\n reply-to : cc : content-type : content-transfer-encoding : sender :\n from; bh=hvztE4AMkbCR5lpgN5k18NRS0NRkMlAM8XVR3N3jgAM=;\n b=YYRYruwHXDzmNyAMnhcB0GqmoijlAztbAWhoQ274JD/tQBZ8/ad3C+7/spNgfDwT5yHG1\n MMUYyPE+jvlIUMgQWRN1ydqpYkmCoqFjLsn0bbmfr0jp7qv6vwV68jTMXKHm6BTDZhMLuc/\n 2Jma5MPaRM3G0LLKnjjh/DZySbljRhs=", "v=1; a=rsa-sha256; d=huawei.com; s=dkim;\n c=relaxed/relaxed; q=dns/txt; h=From;\n bh=mst2VvAGexRkgpsJeGTSWLDVEZQy44lplyCZkLL3GP8=;\n b=Eryvz9kGZuGBAiIv5r9FbQAQ3nA3kzC7C6tNDcB4AT5jqiQ42giE/LaTHh0PtWAx+0Iaxzj7P\n Sc24FfoDi2WbPF9pcwgmJd14e1+qyGD8xgcRwfbh/UEFecQq2YXlxFMoz2qlsbRk7i6AMfr014r\n LBOs2x0pf7qs5E5WhLbp3FM=" ], "dkim-signature": [ "v=1; a=rsa-sha256; c=relaxed/simple; d=lists.linux.it;\n i=@lists.linux.it; q=dns/txt; s=picard; t=1776415869; h=to : date :\n message-id : mime-version : subject : list-id : list-unsubscribe :\n list-archive : list-post : list-help : list-subscribe : from :\n reply-to : cc : content-type : content-transfer-encoding : sender :\n from; bh=hvztE4AMkbCR5lpgN5k18NRS0NRkMlAM8XVR3N3jgAM=;\n b=YYRYruwHXDzmNyAMnhcB0GqmoijlAztbAWhoQ274JD/tQBZ8/ad3C+7/spNgfDwT5yHG1\n MMUYyPE+jvlIUMgQWRN1ydqpYkmCoqFjLsn0bbmfr0jp7qv6vwV68jTMXKHm6BTDZhMLuc/\n 2Jma5MPaRM3G0LLKnjjh/DZySbljRhs=", "v=1; a=rsa-sha256; d=huawei.com; s=dkim;\n c=relaxed/relaxed; q=dns/txt; h=From;\n bh=mst2VvAGexRkgpsJeGTSWLDVEZQy44lplyCZkLL3GP8=;\n b=Eryvz9kGZuGBAiIv5r9FbQAQ3nA3kzC7C6tNDcB4AT5jqiQ42giE/LaTHh0PtWAx+0Iaxzj7P\n Sc24FfoDi2WbPF9pcwgmJd14e1+qyGD8xgcRwfbh/UEFecQq2YXlxFMoz2qlsbRk7i6AMfr014r\n LBOs2x0pf7qs5E5WhLbp3FM=" ], "To": "<ltp@lists.linux.it>, <krzysztof.kozlowski@canonical.com>,\n <pvorel@suse.cz>", "Date": "Fri, 17 Apr 2026 10:29:49 +0800", "Message-ID": "<20260417022949.2881047-1-zhanghongtao35@huawei.com>", "X-Mailer": "git-send-email 2.43.0", "MIME-Version": "1.0", "X-Originating-IP": "[10.50.85.180]", "X-ClientProxiedBy": "kwepems100002.china.huawei.com (7.221.188.206) To\n dggpemr500010.china.huawei.com (7.185.36.210)", "X-Spam-Status": "No, score=0.1 required=7.0 tests=DKIM_SIGNED,DKIM_VALID,\n DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS shortcircuit=no\n autolearn=disabled version=4.0.1", "X-Spam-Checker-Version": "SpamAssassin 4.0.1 (2024-03-25) on in-5.smtp.seeweb.it", "X-Virus-Scanned": "clamav-milter 1.0.9 at in-5.smtp.seeweb.it", "X-Virus-Status": "Clean", "X-Mailman-Approved-At": "Fri, 17 Apr 2026 10:51:05 +0200", "Subject": "[LTP] [PATCH] tpci: Unbind/rebind driver in test_assign_resources()", "X-BeenThere": "ltp@lists.linux.it", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "Linux Test Project <ltp.lists.linux.it>", "List-Unsubscribe": "<https://lists.linux.it/options/ltp>,\n <mailto:ltp-request@lists.linux.it?subject=unsubscribe>", "List-Archive": "<http://lists.linux.it/pipermail/ltp/>", "List-Post": "<mailto:ltp@lists.linux.it>", "List-Help": "<mailto:ltp-request@lists.linux.it?subject=help>", "List-Subscribe": "<https://lists.linux.it/listinfo/ltp>,\n <mailto:ltp-request@lists.linux.it?subject=subscribe>", "From": "Hongtao Zhang via ltp <ltp@lists.linux.it>", "Reply-To": "Hongtao Zhang <zhanghongtao35@huawei.com>", "Cc": "bhelgaas@google.com, liuyongqiang13@huawei.com", "Content-Type": "text/plain; charset=\"us-ascii\"", "Content-Transfer-Encoding": "7bit", "Errors-To": "ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it", "Sender": "\"ltp\" <ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it>" }, "content": "[Problem]\nA kernel panic (UAF) occurs during cat /proc/iomem following this sequence:\nltp_tpci test -> remove driver module -> cat /proc/iomem.\nThe crash happens when the kernel traverses the iomem tree and attempts to\naccess the driver name of a hinic NIC node.\n\n[Panic Log]\n[ 1621.313131] Unable to handle kernel paging request at virtual address ffffc272c2eb21c0\n...\n[ 1621.699915] Call trace:\n[ 1621.706132] string+0x54/0x130\n[ 1621.712899] vsnprintf+0x248/0x6f0\n[ 1621.719989] seq_printf+0xc4/0xe8\n[ 1621.726941] r_show+0xc4/0x100\n[ 1621.733555] seq_read_iter+0x358/0x478\n[ 1621.740846] proc_reg_read_iter+0x68/0xe8\n[ 1621.748410] vfs_read+0x200/0x2b0\n[ 1621.755224] ksys_read+0x78/0x118\n[ 1621.761961] __arm64_sys_read+0x24/0x38\n[ 1621.769169] invoke_syscall+0x50/0x128\n[ 1621.776226] el0_svc_common.constprop.0+0xc8/0xf0\n[ 1621.784206] do_el0_svc+0x24/0x38\n[ 1621.790723] el0_svc+0x44/0x200\n[ 1621.796996] el0t_64_sync_handler+0x100/0x130\n[ 1621.804445] el0t_64_sync+0x188/0x190\n\n[Output of cat /proc/iomem in vmcore]\n(res@ffff284005be3b00):30a000000000-313fffffffff : PCI Bus 0000:95 (name@ffff08400fd074e8)\n (res@ffff282006696778):30a000000000-30a0113fffff : PCI Bus 0000:96 (name@ffff28200668d0e8)\n (res@ffff282006690778):30a000000000-30a0113fffff : PCI Bus 0000:97 (name@ffff28200668f8e8)\n (res@ffff282006693778):30a000000000-30a0044fffff : PCI Bus 0000:9b (name@ffff2820066990e8)\n (res@ffff2820066a7678):30a000000000-30a003bfffff : 0000:9b:00.0 (name@ffff08400fd063d0)\n (res@ffff2820066a74b8):30a003c00000-30a003cfffff : 0000:9b:00.0 (name@ffff08400fd063d0)\n (res@ffff2820066a73b8):30a003d00000-30a003d1ffff : 0000:9b:00.0 (name@ffff08400fd063d0)\n (res@ffff2820066a75f8):30a003d20000-30a003efffff : 0000:9b:00.0 (name@ffff08400fd063d0)\n (res@ffff2820066a7438):30a003f00000-30a003f07fff : 0000:9b:00.0 (name@ffff08400fd063d0)\n\t\t\t(res@ffff28201699cf00):30a0044a0000-30a0044a7fff : gdb: invalid kernel virtual address:\tffffc272c2eb21c0: type:\t\"gdb readmem callback\"\ngdb: gdb request failed: dump_iomem\ncrash>\n\n[Root Cause]\nIn test_assign_resources(), a hinic BAR is reassigned to a different physical\naddress. When the hinic driver is later removed, its .remove callback fails to\nrelease the resource because the driver's claimed range no longer matches the\nreassigned BAR range.\nConsequently, the resource node remains in the iomem tree after the module is\nunloaded. Since resource->name points to the module's reclaimed memory,\nit becomes a dangling pointer. Traversing /proc/iomem dereferences this\ninvalid pointer, triggering the UAF panic.\n\n[Fix]\nIn test_assign_resources(), for end-devices:\nunbind drivers before calling pci_release_resource;\nrebind driver after pci_assign_resource().\n\nFixes: d631e9caef68 (\"ltp_tpci.c: Add release operation before allocation\")\nSigned-off-by: Hongtao Zhang <zhanghongtao35@huawei.com>\n---\n .../device-drivers/pci/tpci_kernel/ltp_tpci.c | 17 +++++++++++++++++\n 1 file changed, 17 insertions(+)", "diff": "diff --git a/testcases/kernel/device-drivers/pci/tpci_kernel/ltp_tpci.c b/testcases/kernel/device-drivers/pci/tpci_kernel/ltp_tpci.c\nindex 660b3a423..2790a15d6 100644\n--- a/testcases/kernel/device-drivers/pci/tpci_kernel/ltp_tpci.c\n+++ b/testcases/kernel/device-drivers/pci/tpci_kernel/ltp_tpci.c\n@@ -442,9 +442,26 @@ static int test_assign_resources(void)\n \n \t\tif (r->flags & IORESOURCE_MEM &&\n \t\t\tr->flags & IORESOURCE_PREFETCH) {\n+\n+\t\t\tif (dev->hdr_type == PCI_HEADER_TYPE_NORMAL) {\n+\t\t\t\tif (dev->dev.driver)\n+\t\t\t\t\tdevice_release_driver(&dev->dev);\n+\t\t\t}\n+\n \t\t\tpci_release_resource(dev, i);\n \t\t\tret = pci_assign_resource(dev, i);\n \t\t\tprk_info(\"assign resource to '%d', ret '%d'\", i, ret);\n+\n+\t\t\tif (ret == 0) {\n+\t\t\t\tif (dev->hdr_type == PCI_HEADER_TYPE_NORMAL) {\n+\t\t\t\t\tint attach_ret;\n+\n+\t\t\t\t\tattach_ret = device_attach(&dev->dev);\n+\t\t\t\t\tif (attach_ret < 0)\n+\t\t\t\t\t\tprk_info(\"device_attach failed for endpoint, ret: %d\", attach_ret);\n+\t\t\t\t}\n+\t\t\t}\n+\n \t\t\trc |= (ret < 0 && ret != -EBUSY) ? TFAIL : TPASS;\n \t\t}\n \t}\n", "prefixes": [] }