Re: [PATCH] can: kvaser_pciefd: fix use-after-free in bec poll timer

[Marc Kleine-Budde]

On 18.08.2026 21:22:51, Fan Wu wrote:
> Hi Marc,
>
> Yes. The driver has three timer_delete() call sites, all for
> bec_poll_timer.
>
> The calls in kvaser_pciefd_bus_on() and kvaser_pciefd_stop() are runtime
> cancellations: the CAN device stays alive after both, and the timer must
> stay rearmable for the next open/bus-on cycle, since the interrupt
> handler arms it from handle_error_packet(), handle_status_resp() and
> handle_status_packet().  Converting either one to timer_shutdown_sync()
> would make those later mod_timer() calls no-ops.  The stop() flush-timeout
> path, which skips its timer_delete() entirely, is also covered: the device
> is still alive there, and remove() still shuts the timer down
> unconditionally.
>
> kvaser_pciefd_remove() is different: its timer_delete() is followed by
> free_irq() and then by the final free_candev(), while the interrupt
> handler can still rearm the timer.  That is the call converted by this
> patch, which also adds timer_shutdown_sync() to
> kvaser_pciefd_teardown_can_ctrls(), the probe-error path that frees the
> CAN devices after free_irq().

Thanks for the explanation.

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

Attachment: signature.asc
Description: PGP signature