Re: [PATCH] ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition

[Logan Gunthorpe]

On 2024-09-09 11:20, Kaixin Wang wrote:
> In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev
> function, then &sndev->check_link_status_work is bound with
> check_link_status_work. switchtec_ntb_link_notification may be called
> to start the work.
> 
> If we remove the module which will call switchtec_ntb_remove to make
> cleanup, it will free sndev through kfree(sndev), while the work
> mentioned above will be used. The sequence of operations that may lead
> to a UAF bug is as follows:
> 
> CPU0                                 CPU1
> 
>                         | check_link_status_work
> switchtec_ntb_remove    |
> kfree(sndev);           |
>                         | if (sndev->link_force_down)
>                         | // use sndev
> 
> Fix it by ensuring that the work is canceled before proceeding with
> the cleanup in switchtec_ntb_remove.

Thank you, this looks good to me.

Reviewed-by: Logan Gunthorpe <logang@xxxxxxxxxxxx>