Re: [PATCH] mmc: vub300: fix Use-After-Free of inactivity_timer on disconnect and probe failure

[Johan Hovold]

[ Please avoid top-posting when replying on the lists. ]

On Wed, Aug 19, 2026 at 07:33:25PM +0500, Muhammad Bilal wrote:

> You're right, thank you for catching this. I traced through
> vub300_probe() and vub300_inactivity_timer_expired() again: the
> kref_get() taken right before add_timer() is exactly the extra
> reference the timer holds, and the timer callback releases it itself
> and stops rearming once vub300->interface is NULL. So the UAF I
> described can't happen with the code as it stands.
> 
> I should also be upfront that this was flagged by Sashiko, and I did
> not verify the reference counting closely enough myself before sending
> it.

Remember to mention when issues were found (or fixed) by tools like
Sashiko or LLMs generally in the commit message of any future patches as
its useful information for reviewers and maintainers (and as is also
documented as being required).

Johan