Re: [PATCH] usb: atm: cxacru: fix use-after-free in cxacru_poll_status

[Greg KH]

On Mon, Aug 03, 2026 at 06:17:16PM +0800, Nguyen Quang Le Kien wrote:
> In cxacru_unbind(), cancel_delayed_work_sync() was conditionally skipped
> when poll_state was CXPOLL_STOPPED. However, a work item previously
> scheduled when poll_state was CXPOLL_POLLING may still be pending in the
> workqueue at the time poll_state transitions to CXPOLL_STOPPED. Skipping
> cancel_delayed_work_sync() in this case allows the work to fire after
> cxacru_data is freed, causing a use-after-free when cxacru_poll_status()
> attempts to acquire instance->poll_state_serialize.
> 
> Fix this by always calling cancel_delayed_work_sync() regardless of
> poll_state, ensuring no pending or in-flight work can access the freed
> instance.
> 
> Reported-by: syzbot+24eb38c789655fc43663@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=24eb38c789655fc43663
> Signed-off-by: Nguyen Quang Le Kien <khiemtranzo532001@xxxxxxxxx>
> ---
>  drivers/usb/atm/cxacru.c | 10 +---------
>  1 file changed, 1 insertion(+), 9 deletions(-)

Did you forget the assisted-by: tag?

And how did you test this?

thanks.

greg k-h