Re: [PATCH] amt: fix use-after-free in AMT delayed works

[Simon Horman]

On Tue, Jul 14, 2026 at 03:27:05PM +0800, Shihuang Liu wrote:
> When an AMT device is removed, pending delayed works can still access
> the freed amt_dev structure, which may result in kernel crashes or
> memory corruption.
> 
> amt_dev_stop() cancels req_wq and discovery_wq with
> cancel_delayed_work_sync(), but these works can be scheduled again
> from event_wq after the cancellation. This allows delayed works to
> access the freed amt_dev structure after the netdev has been released.
> 
> The following is a simple race scenario:
> 
> CPU0                         CPU1
> 
> amt_dev_stop()
> cancel_delayed_work_sync()
>                              amt_event_work()
>                              mod_delayed_work(req_wq)
> free netdev
>                              req_wq accesses freed amt_dev
> 
> Use disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and
> discovery_wq from being queued again and wait for running work items
> to complete.
> 
> The delayed works are disabled after initialization in
> amt_newlink() and enabled only when the device is successfully opened.
> This keeps the delayed work lifecycle synchronized with the lifetime
> of the AMT device.
> 
> Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Shihuang Liu <shlomojune6@xxxxxxxxx>

...

This patch seems fine to me, however, as it was not marked as
being for net our CI tried to apply it to net-next, which failed
due to a conflict there.

Please consider resubmitting with the patch targeted at the net tree like
this:

Subject: [PATCH REPOST net] ...

Feel free to include:

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>

Thanks!

-- 
pw-bot: changes-requested