Re: [PATCH net v3 2/2] s390/ctcm: Fix use-after-free in channel_remove()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] s390/ctcm: timer_delete_sync() placed after tasklet_kill() causes UAF
--

commit 93e7e140a56ccbd4e4b9fe414316e60f45884b2b
Author: Nagamani PV <nagamani@linux.ibm.com>

s390/ctcm: Fix use-after-free in channel_remove()

This commit modifies the teardown sequence in channel_remove() to fix a
use-after-free. It calls timer_delete_sync() directly instead of through
fsm_deltimer(), and kills MPC tasklets and stops the sweep timer before
deleting the main channel timer and freeing memory.

Link: https://sashiko.dev/#/patchset/20260803182736.2356374-1-nagamani@linux.ibm.com?part=1

> diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
> --- a/drivers/s390/net/ctcm_main.c
> +++ b/drivers/s390/net/ctcm_main.c
> @@ -211,9 +211,13 @@ static void channel_remove(struct channel *ch)
>  	while (*c) {
>  		if (*c == ch) {
>  			*c = ch->next;
> -			fsm_deltimer(&ch->timer);
> -			if (IS_MPC(ch))
> -				fsm_deltimer(&ch->sweep_timer);
> +			if (IS_MPC(ch)) {
> +				tasklet_kill(&ch->ch_tasklet);
> +				tasklet_kill(&ch->ch_disc_tasklet);
> +				timer_shutdown_sync(&ch->sweep_timer.tl);
> +				kfree(ch->discontact_th);
> +			}
> +			timer_delete_sync(&ch->timer.tl);

[Severity: High]
Does placing timer_delete_sync() after tasklet_kill() and kfree() leave a race
window that could lead to a use-after-free?

If the timer callback (fsm_expire_timer) is executing concurrently on another
CPU, could it dispatch an event (e.g., via ctcm_chx_txretry()) that invokes
mpc_action_go_inop() and schedules the tasklet again?

    tasklet_hi_schedule(&wch->ch_disc_tasklet);

Since tasklet_kill() has already completed, would this newly scheduled tasklet
execute later and call mpc_action_send_discontact(), initiating a DMA
operation that reads from the already freed ch->discontact_th using the freed
ch and ch->ccw structures?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922101913.239103-1-nagamani@linux.ibm.com?part=2