Re: [PATCH] staging: vme_user: fake: stop tasklet before freeing its data

[Greg KH]

On Tue, Aug 11, 2026 at 03:30:39PM +0800, Yunshui Jiang wrote:
> From: jiangyunshui <jiangyunshui@xxxxxxxxxx>

Full name please, not just an email address.

> fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
> dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
> and the err_master error path of fake_init() free
> fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
> without calling tasklet_kill(), so a pending or running tasklet may
> access already-freed memory (use-after-free).

How was this found and tested?

thanks,

greg k-h