Re: [PATCH net-next 33/37] can: kvaser_pciefd: fix use-after-free in bec poll timer

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] can: kvaser_pciefd: missing SRB DMA engine shutdown in remove()
--

commit edee436281614056200b58c9acbef8d6681036cd
Author: Fan Wu <fanwu01@zju.edu.cn>

can: kvaser_pciefd: fix use-after-free in bec poll timer

This commit replaces timer_delete() with timer_shutdown_sync() in the device
removal and probe error paths. This ensures any running timer callbacks are
completed before the CAN devices are freed, preventing a use-after-free.

Link: https://patch.msgid.link/20260818063832.383829-1-fanwu01@zju.edu.cn

> diff --git a/drivers/net/can/kvaser_pciefd/kvaser_pciefd_core.c b/drivers/net/can/kvaser_pciefd/kvaser_pciefd_core.c
> index d8c9bfb202304..a0597db720864 100644
> --- a/drivers/net/can/kvaser_pciefd/kvaser_pciefd_core.c
> +++ b/drivers/net/can/kvaser_pciefd/kvaser_pciefd_core.c
[ ... ]
> @@ -1879,7 +1880,7 @@ static void kvaser_pciefd_remove(struct pci_dev *pdev)
>  		struct kvaser_pciefd_can *can = pcie->can[i];
>  
>  		unregister_candev(can->can.dev);
> -		timer_delete(&can->bec_poll_timer);
> +		timer_shutdown_sync(&can->bec_poll_timer);
>  		kvaser_pciefd_pwm_stop(can);
>  		kvaser_pciefd_devlink_port_unregister(can);
>  	}

[Severity: Medium]
Could this teardown path leave the DMA engine actively running while
unmapping the device registers?

In kvaser_pciefd_probe(), the error path explicitly stops the DMA engine
before clearing the PCI master bit:

    err_teardown_can_ctrls:
        kvaser_pciefd_teardown_can_ctrls(pcie);
        iowrite32(0, KVASER_PCIEFD_SRB_ADDR(pcie) + KVASER_PCIEFD_SRB_CTRL_REG);
        pci_clear_master(pdev);

However, later in kvaser_pciefd_remove(), it proceeds directly to unmap
registers via pci_iounmap() and disable the PCI device without writing 0 to
KVASER_PCIEFD_SRB_CTRL_REG.

Does the SRB DMA engine need to be explicitly shut down here as well to
prevent PCIe AER errors or an inconsistent state across unbind/rebind cycles?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015015336.816543-1-mkl@pengutronix.de?part=33