[PATCH net v3 2/2] s390/ctcm: Fix use-after-free in channel_remove()

[Nagamani PV <nagamani@linux.ibm.com>]

channel_remove() calls fsm_deltimer(), which internally uses
timer_delete(), then immediately frees the channel structure:

  fsm_deltimer(&ch->timer);
  kfree_fsm(ch->fsm);       /* freed while callback may still run */
  kfree(ch);

timer_delete() returns immediately even if the timer callback is
currently executing on another CPU, creating a window where
fsm_expire_timer() accesses this->fi (which points to ch->fsm)
after it has been freed by kfree_fsm().

Fix this by calling timer_delete_sync() directly on the underlying
timer_list fields before freeing, instead of going through
fsm_deltimer(). This cannot be fixed in fsm_deltimer() itself because
FSM action functions triggered by CTC_EVENT_TIMER call fsm_deltimer()
from within the timer callback chain, which would cause a self-deadlock in
timer_delete_sync().

For MPC channels, two additional problems exist. First, freeing
ch->fsm before tasklet_kill() leaves a window where ch_tasklet
(ctcmpc_bh) or ch_disc_tasklet could access the freed ch->fsm. Second,
ch_tasklet can re-arm sweep_timer via ctcmpc_send_sweep_resp(), and
sweep_timer's callback re-arms ch->timer via ctcmpc_chx_send_sweep().

Kill both tasklets before stopping the timers: this closes the freed
ch->fsm access window and eliminates the tasklet-driven sweep_timer
re-arm source. Then use timer_shutdown_sync() for sweep_timer to wait
for any running callback and prevent further re-arms of ch->timer from
sweep_timer. kfree(ch->discontact_th) is moved into this MPC block
after tasklet_kill(ch_disc_tasklet), since mpc_action_send_discontact()
accesses discontact_th.

timer_delete_sync() is retained for ch->timer because normal FSM timer
callbacks can delete and re-arm ch->timer; shutting it down would break
normal operation.

Patch 1 changes fsm_addtimer() to use mod_timer() without reinitializing
the timer, which is required for timer_shutdown_sync() to reliably
prevent subsequent re-arms.

Backporting patch 2 without patch 1 is not safe because the old
fsm_addtimer() reinitializes the timer with timer_setup() before
add_timer().

Fixes: 293d984f0e36 ("ctcm: infrastructure for replaced ctc driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260803182736.2356374-1-nagamani@linux.ibm.com?part=1
Signed-off-by: Nagamani PV <nagamani@linux.ibm.com>
---
Changes in v3:
- Kill ch_tasklet and ch_disc_tasklet before stopping the timers and
  freeing ch->fsm: closes freed ch->fsm access from tasklet context and
  eliminates tasklet-driven sweep_timer re-arm.
- Shut down sweep_timer with timer_shutdown_sync() before deleting
  ch->timer to prevent sweep_timer callback from re-arming ch->timer.
- Move kfree(ch->discontact_th) after tasklet_kill(ch_disc_tasklet).
- Drop Reviewed-by and Tested-by; please re-review and re-test the
  new teardown order.

Changes in v2:
- add Fixes: and Cc: stable@vger.kernel.org tags (Sashiko netdev-bot)
---
 drivers/s390/net/ctcm_main.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
index 8b0d76a47d9f..5053737f11fc 100644
--- a/drivers/s390/net/ctcm_main.c
+++ b/drivers/s390/net/ctcm_main.c
@@ -211,9 +211,13 @@ static void channel_remove(struct channel *ch)
 	while (*c) {
 		if (*c == ch) {
 			*c = ch->next;
-			fsm_deltimer(&ch->timer);
-			if (IS_MPC(ch))
-				fsm_deltimer(&ch->sweep_timer);
+			if (IS_MPC(ch)) {
+				tasklet_kill(&ch->ch_tasklet);
+				tasklet_kill(&ch->ch_disc_tasklet);
+				timer_shutdown_sync(&ch->sweep_timer.tl);
+				kfree(ch->discontact_th);
+			}
+			timer_delete_sync(&ch->timer.tl);
 
 			kfree_fsm(ch->fsm);
 			clear_normalized_cda(&ch->ccw[4]);
@@ -221,11 +225,6 @@ static void channel_remove(struct channel *ch)
 				clear_normalized_cda(&ch->ccw[1]);
 				dev_kfree_skb_any(ch->trans_skb);
 			}
-			if (IS_MPC(ch)) {
-				tasklet_kill(&ch->ch_tasklet);
-				tasklet_kill(&ch->ch_disc_tasklet);
-				kfree(ch->discontact_th);
-			}
 			kfree(ch->ccw);
 			kfree(ch->irb);
 			kfree(ch);
-- 
2.53.0