Re: [PATCH net v4] atm: fore200e: fix use-after-free in tasklets during device removal

[Simon Horman]

On Tue, Feb 10, 2026 at 05:45:37PM +0800, Duoming Zhou wrote:
> When the PCA-200E or SBA-200E adapter is being detached, the fore200e
> is deallocated. However, the tx_tasklet or rx_tasklet may still be running
> or pending, leading to use-after-free bug when the already freed fore200e
> is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().
> 
> One of the race conditions can occur as follows:
> 
> CPU 0 (cleanup)           | CPU 1 (tasklet)
> fore200e_pca_remove_one() | fore200e_interrupt()
>   fore200e_shutdown()     |   tasklet_schedule()
>     kfree(fore200e)       | fore200e_tx_tasklet()
>                           |   fore200e-> // UAF
> 
> Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before
> the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to
> synchronize with any pending or running tasklets. Moreover, since
> fore200e_reset() could prevent further interrupts or data transfers,
> the tasklet_kill() should be placed after fore200e_reset() to prevent
> the tasklet from being rescheduled in fore200e_interrupt(). Finally,
> it only needs to do tasklet_kill() when the fore200e state is greater
> than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized
> in earlier states. In a word, the tasklet_kill() should be placed in
> the FORE200E_STATE_IRQ branch within the switch...case structure.
> 
> This bug was identified through static analysis.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxx
> Suggested-by: Jijie Shao <shaojijie@xxxxxxxxxx>
> Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx>
> Reviewed-by: Jijie Shao <shaojijie@xxxxxxxxxx>
> ---
> Changes in v4:
>   - Do tasklet_kill() in "switch(fore200e->state)-case FORE200E_STATE_IRQ" branch.
>   - Make the commit messages clearer.

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>