Re: [PATCH net] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()

[duoming]

On Tue, 16 Sep 2025 16:36:43 -0700 Jakub Kicinski wrote:
> > Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
> > that the delayed work item is properly canceled before the otx2_ptp is
> > deallocated.
> 
> Please add info about how the bug was discovered and fix tested, same
> as the cnic patch.

Thank you for your suggestions. This bug was initially identified through
static analysis. To reproduce and test it, I simulated the OcteonTX2 PCI
device in QEMU and introduced artificial delays — such as adding calls to
ssleep() within the otx2_sync_tstamp() function — to increase the probability
of triggering the issue.

The otx2_sync_tstamp() function operates as a cyclic work item. 
The cancel_delayed_work_sync() function works by calling 
__cancel_work(work, ... | WORK_CANCEL_DISABLE), which attempts to 
remove the work item from the queue and sets the WORK_CANCEL_DISABLE 
flag to prevent the work item from being executed again. At the same 
time, it uses __flush_work(work, true) to perform a synchronous wait 
for any currently executing instance of the work item to finish running.

I will add info about how the bug was discovered and fix tested in patch v2.

Best regards,
Duoming Zhou