Re: [PATCH] PCI: switchtec: Fix use-after-free in mrpc_timeout_work

[Manivannan Sadhasivam]

On Thu, Aug 06, 2026 at 07:55:15PM +0800, Pei Xiao wrote:
> stdev_kill() cancels the works before clearing stdev->alive under
> mrpc_mutex. Every path that arms mrpc_timeout holds that mutex, so a
> write that already passed the alive check can still schedule
> mrpc_timeout after cancel_delayed_work_sync() returns:
> 
> CPU0                                      CPU1
> 
>                                           | switchtec_dev_write()
>                                           | lock_mutex_and_test_alive()
> cancel_delayed_work_sync(mrpc_timeout)    |
>                                           | mrpc_cmd_submit()
>                                           | schedule_delayed_work(mrpc_timeout)
>                                           | mutex_unlock(&stdev->mrpc_mutex)
> scoped_guard(mutex) { alive = false }     |
> put_device() -> kfree(stdev)              |
>                                           | mrpc_timeout_work
> 
> Fix it by clearing alive under mrpc_mutex before canceling the works, so no
> new mrpc_timeout can be armed once alive is cleared.
> 
> Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Codex:deepseek-v4-flash
> Signed-off-by: Pei Xiao <xiaopei01@xxxxxxxxxx>
> ---
>  drivers/pci/switch/switchtec.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
> index 235ca1877b6c..9127841b2bf8 100644
> --- a/drivers/pci/switch/switchtec.c
> +++ b/drivers/pci/switch/switchtec.c
> @@ -1323,10 +1323,6 @@ static void stdev_kill(struct switchtec_dev *stdev)
>  	if (stdev->dma_mrpc_irq >= 0)
>  		devm_free_irq(&stdev->pdev->dev, stdev->dma_mrpc_irq, stdev);
>  
> -	cancel_work_sync(&stdev->mrpc_work);
> -	cancel_work_sync(&stdev->link_event_work);
> -	cancel_delayed_work_sync(&stdev->mrpc_timeout);
> -

This part of the code never existed in upstream. Perhaps you are referring to
some downstream tree?

- Mani

-- 
மணிவண்ணன் சதாசிவம்