Thread (3 messages) 3 messages, 2 authors, 3d ago

Re: [PATCH v1] vdpa/octeon_ep: Fix race condition in device deletion

From: Yuho Choi <hidden>
Date: 2026-09-15 15:48:20
Also in: sashiko-reviews

On Mon, 14 Sept 2026 at 00:17, [off-list ref] wrote:
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:

New issues:
- [High] Incorrect teardown ordering in `octep_vdpa_remove_vf` allows hardware interrupts to re-queue the event worker after it has been cancelled, leading to a Use-After-Free of `mgmt_dev`.
- [High] The lockless `atomic_cmpxchg` synchronization introduced in `octep_vdpa_dev_del` is vulnerable to an ABA problem, allowing a Use-After-Free of a stale `vdpa_device` pointer.
- [High] Early return in `octep_vdpa_dev_del` silently skips unregistering devices if multiple vDPA devices are mistakenly attached, leading to a permanent device leak.
- [Medium] Calling `cancel_work_sync()` on a potentially uninitialized work struct triggers a kernel warning (`WARN_ON(!work->func)`).
Thanks for the review.
Please drop this version.
I will rework it and send v2 based on the review.

Please also drop the Cc: stable -- it was premature on v1.

Thanks,
Yuho
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help