Re: [PATCH] usb: atm: cxacru: stop polling on device shutdown

[Greg KH]

On Tue, Aug 04, 2026 at 10:28:36PM +0530, Anuj Bolewar via B4 Relay wrote:
> From: Anuj Bolewar <bolewara@xxxxxxxxx>
> 
> cxacru_unbind() sets poll_state to CXPOLL_SHUTDOWN under
> poll_state_serialize and then calls cancel_delayed_work_sync(). If
> cxacru_poll_status() is already running it only stops rescheduling when
> it observes CXPOLL_STOPPED; CXPOLL_SHUTDOWN is ignored, so a running
> worker re-queues itself. cancel_delayed_work_sync() then returns while a
> delayed work is still pending, and the work fires after cxacru_unbind()
> has freed the instance, causing a use-after-free.
> 
> Treat CXPOLL_SHUTDOWN like CXPOLL_STOPPED in the reschedule decision so
> a worker that sees the shutdown state stops polling and cannot re-queue
> itself after unbind.
> 
> Reported-by: syzbot+e4b1171e7c5ae2556f9e@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=e4b1171e7c5ae2556f9e
> Assisted-by: deepseek:v4-pro
> Signed-off-by: Anuj Bolewar <bolewara@xxxxxxxxx>
> ---
> cxacru_poll_status() reschedules itself with schedule_delayed_work()
> unless poll_state is CXPOLL_STOPPED. cxacru_unbind() sets poll_state
> to CXPOLL_SHUTDOWN and relies on cancel_delayed_work_sync() to stop
> the worker, but a worker that is already running when unbind starts
> never observes CXPOLL_STOPPED and re-queues itself, so the delayed
> work still fires after the instance has been freed.
> 
> Treat CXPOLL_SHUTDOWN like CXPOLL_STOPPED when deciding whether to
> reschedule, so a running worker cannot re-queue itself during unbind.
> ---
>  drivers/usb/atm/cxacru.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Did syzbot ever test this?  I don't see that in the link above :(

thanks,

greg k-h