On 2024-09-09 11:20, Kaixin Wang wrote: > In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev > function, then &sndev->check_link_status_work is bound with > check_link_status_work. switchtec_ntb_link_notification may be called > to start the work. > > If we remove the module which will call switchtec_ntb_remove to make > cleanup, it will free sndev through kfree(sndev), while the work > mentioned above will be used. The sequence of operations that may lead > to a UAF bug is as follows: > > CPU0 CPU1 > > | check_link_status_work > switchtec_ntb_remove | > kfree(sndev); | > | if (sndev->link_force_down) > | // use sndev > > Fix it by ensuring that the work is canceled before proceeding with > the cleanup in switchtec_ntb_remove. Thank you, this looks good to me. Reviewed-by: Logan Gunthorpe <logang@xxxxxxxxxxxx>
