Re: [PATCH v2] staging: vme_user: fake: stop tasklet before freeing its data

[Greg KH]

On Tue, Aug 11, 2026 at 05:24:59PM +0800, Yunshui Jiang wrote:
> fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
> dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
> and the err_master error path of fake_init() free
> fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
> without calling tasklet_kill(), so a pending or running tasklet may
> access already-freed memory (use-after-free).
> 
> Add tasklet_kill() before the frees in both paths.
> 
> Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
> Assisted-by: Claude-Code:GLM-5.2
> Signed-off-by: Yunshui Jiang <jiangyunshui@xxxxxxxxxx>
> ---
>  drivers/staging/vme_user/vme_fake.c | 3 +++
>  1 file changed, 3 insertions(+)

As per:
	https://lore.kernel.org/all/2026080354-skater-urgent-31b2@gregkh/T/#u
I can not take this change, sorry.

thanks,

greg k-h