From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Yibo Tan <lhfff@tju.edu.cn>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>,
Richard Weinberger <richard@nod.at>,
Vignesh Raghavendra <vigneshr@ti.com>,
linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v1] mtd: rawnand: r852: Prevent card work during removal
Date: Sun, 20 Sep 2026 15:25:25 +0200 [thread overview]
Message-ID: <87zexc837e.fsf@bootlin.com> (raw)
In-Reply-To: <20260915144543.3466083-1-lhfff@tju.edu.cn> (Yibo Tan's message of "Tue, 15 Sep 2026 22:45:43 +0800")
On 15/09/2026 at 22:45:43 +08, Yibo Tan <lhfff@tju.edu.cn> wrote:
> r852_irq() queues card_detect_work when card state changes. r852_remove()
> currently cancels that work and destroys its private workqueue before it
> disables and frees the IRQ.
>
> A card event in this interval can queue delayed work on the destroyed
> workqueue. Its timer is part of struct r852_device, which is freed later
> in r852_remove(). KASAN reported a use-after-free in the timer code when
> the card interrupt occurred in this interval. The same test completed
> without a kernel diagnostic after this change.
>
> Set a removal flag while holding irqlock before cancelling the work. The
> IRQ handler still acknowledges and disables card events, but does not
> queue more card-detect work during removal. The lock ensures that work
> queued before the flag is cancelled and later interrupts skip the
> queue.
Why don't you just disable the IRQs? There is a helper for that.
Thanks,
Miquèl
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
prev parent reply other threads:[~2026-09-20 13:26 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-15 14:45 [PATCH v1] mtd: rawnand: r852: Prevent card work during removal Yibo Tan
2026-09-20 13:25 ` Miquel Raynal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87zexc837e.fsf@bootlin.com \
--to=miquel.raynal@bootlin.com \
--cc=lhfff@tju.edu.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=maximlevitsky@gmail.com \
--cc=richard@nod.at \
--cc=vigneshr@ti.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.