MPAM Fixes for UAF and NPE on unbind

[PATCH v1 0/2] MPAM Fixes for UAF and NPE on unbind

Posted by Ben Horgan 1 month, 3 weeks ago

The MPAM driver expects to manage all the MSC in a system. At boot it
delays its initialization until it has probed all of them but once
running it is unprepared to have the MSC taken away and that can trigger
UAF and NPE. Workaround this by ensuring it never relinquishes the MSC.

Ben Horgan (2):
  arm_mpam: Fix a NULL pointer dereference on unbinding after an error
    interrupt
  arm_mpam: Disable driver unbind to avoid UAF

 drivers/resctrl/mpam_devices.c | 4 ++++
 1 file changed, 4 insertions(+)

-- 
2.43.0

Re: [PATCH v1 0/2] MPAM Fixes for UAF and NPE on unbind

Posted by Will Deacon 1 month, 3 weeks ago

On Thu, Aug 06, 2026 at 03:46:29PM +0100, Ben Horgan wrote:
> The MPAM driver expects to manage all the MSC in a system. At boot it
> delays its initialization until it has probed all of them but once
> running it is unprepared to have the MSC taken away and that can trigger
> UAF and NPE. Workaround this by ensuring it never relinquishes the MSC.
> 
> Ben Horgan (2):
>   arm_mpam: Fix a NULL pointer dereference on unbinding after an error
>     interrupt
>   arm_mpam: Disable driver unbind to avoid UAF
> 
>  drivers/resctrl/mpam_devices.c | 4 ++++
>  1 file changed, 4 insertions(+)

Thanks, I've applied these but you got Catalin's email address wrong
(I've fixed it for this reply) so the thank you email failed to go out.

Will