At 2024-09-10 02:17:57, "Logan Gunthorpe" <logang@xxxxxxxxxxxx> wrote: > > >On 2024-09-09 11:20, Kaixin Wang wrote: >> In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev >> function, then &sndev->check_link_status_work is bound with >> check_link_status_work. switchtec_ntb_link_notification may be called >> to start the work. >> >> If we remove the module which will call switchtec_ntb_remove to make >> cleanup, it will free sndev through kfree(sndev), while the work >> mentioned above will be used. The sequence of operations that may lead >> to a UAF bug is as follows: >> >> CPU0 CPU1 >> >> | check_link_status_work >> switchtec_ntb_remove | >> kfree(sndev); | >> | if (sndev->link_force_down) >> | // use sndev >> >> Fix it by ensuring that the work is canceled before proceeding with >> the cleanup in switchtec_ntb_remove. > >Thank you, this looks good to me. > >Reviewed-by: Logan Gunthorpe <logang@xxxxxxxxxxxx> > Thanks for the review! Best regards, Kaixin Wang
