Skip to main content

Driver UAF on module unload (issue #4) — and the right channel for driver/runtime patches?

  • June 27, 2026
  • 1 reply
  • 15 views

Hi everyone — I'm Lorenco, a Rust/C++ compiler & real-time/kernel systems engineer (based in Italy), getting to know the Metis/Voyager stack.

While reading axelera-driver I came across GitHub issue #4 — the use-after-free in axl_aipu_remove() on `modprobe -r metis`. It looks correctly root-caused: the MSI handlers dereference dma_va, but the devm-managed IRQs are only released after remove() returns, so a late MSI hits the freed DMA buffer (synchronize_irq() alone doesn't mask the vector). Quiescing DMA/MSI before the free would also unblock a clean S3 suspend path.

Two questions:
1. Is the GitHub repo the right place to send driver patches, or do you handle those through another channel?
2. More broadly — I do low-level compiler/runtime/driver work and would be glad to contribute. Where's the best spot for someone outside the team to pick things up?

Background, in case useful: I recently contributed a canonicalization fix to Tenstorrent's tt-mlir compiler (github.com/tenstorrent/tt-mlir/pull/8912), and I build std-only real-time systems in Rust — NSI (github.com/Lorencoshametaj/nsi). Thanks!

 

1 reply

Spanner
Axelera Team
Forum|alt.badge.img+3
  • Axelera Team
  • July 1, 2026

Wow, nice work ​@Lorenco Shametaj !

Do feel free to share any of that right here in the community. I don’t think the Git is currently open for that, but the team keeps a close eye on anything people share here, so you can be sure that any suggestions, patches, contributions, or any of your own repos that are shared will be seen by everyone at Axelera.

If it’s a specific feature request or idea, the Launchpad is a good place for that, too.