Re: [PATCH net v2 2/2] s390/ctcm: Fix use-after-free in channel_remove()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] timer: use-after-free in channel_remove() due to re-arming after timer_delete_sync()
--

commit f0230a69308edd523997bd09005283eab61bb03e
Author: Nagamani PV <nagamani@linux.ibm.com>

s390/ctcm: Fix use-after-free in channel_remove()

This commit attempts to fix a use-after-free in channel_remove() by replacing
fsm_deltimer() calls with direct calls to timer_delete_sync() before freeing
the channel structure. The commit message states timer_shutdown_sync() was
avoided to prevent self-deadlocks if FSM action functions call fsm_deltimer()
from within the timer callback chain.

Link: https://sashiko.dev/#/patchset/20260803182736.2356374-1-nagamani@linux.ibm.com?part=1

> diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
> --- a/drivers/s390/net/ctcm_main.c
> +++ b/drivers/s390/net/ctcm_main.c
> @@ -211,9 +211,9 @@ static void channel_remove(struct channel *ch)
>  	while (*c) {
>  		if (*c == ch) {
>  			*c = ch->next;
> -			fsm_deltimer(&ch->timer);
> +			timer_delete_sync(&ch->timer.tl);
>  			if (IS_MPC(ch))
> -				fsm_deltimer(&ch->sweep_timer);
> +				timer_delete_sync(&ch->sweep_timer.tl);

[Severity: High]
Can this sequence lead to a use-after-free if the main timer is re-armed
during teardown?

Looking at channel_remove(), the patch deliberately uses timer_delete_sync()
instead of timer_shutdown_sync(). While timer_delete_sync() waits for a
running callback to finish, it does not mark the timer as shut down or
prevent it from being re-armed.

If a concurrent sweep_timer callback executes during channel_remove(), it
can re-arm the main timer via ctcmpc_chx_send_sweep():

drivers/s390/net/ctcm_fsms.c:ctcmpc_chx_send_sweep() {
    ...
    fsm_addtimer(&wch->timer, CTCM_TIME_5_SEC, CTC_EVENT_TIMER, wch);
    fsm_newstate(wch->fsm, CTC_STATE_TX);
    ...
}

If channel_remove() calls timer_delete_sync() on ch->timer.tl first, and
then spin-waits for ch->sweep_timer.tl, the sweep_timer callback could
re-arm ch->timer right before the teardown thread proceeds to free the
channel structure via kfree(ch).

Since the kernel Timer API requires timer_shutdown_sync() to safely
prevent this exact re-arming scenario before freeing, does leaving the
timer capable of being re-armed leave it active on the timer wheel after
the channel memory is gone?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916132149.4185912-1-nagamani@linux.ibm.com?part=2