Re: [PATCH] PCI: endpoint: pci-epf-ntb: cancel cmd_handler synchronously on cleanup

[sashiko-bot@kernel.org]

> epf_ntb_cmd_handler() re-arms itself unconditionally every 5ms at
> reset_handler, with no guard at all.  epf_ntb_epc_cleanup_interface()
> uses cancel_delayed_work(), which cannot stop a running callback: if
> the cleanup (configfs unbind) happens while the handler is mid-flight,
> the handler re-arms, and the delayed work fires after the devm-managed
> ntb_epc - and the devm_ioremap'd ntb_epc->reg it dereferences - have
> been released.  Use-after-free.
> 
> The per-attempt race window is small (sub-microsecond callback vs a 5ms
> period), but configfs bind/unbind cycles can simply be repeated (root)
> until the race is won.
> 
> Use cancel_delayed_work_sync(), which waits for a running callback and
> prevents its re-arm from taking effect.
> 
> Found by static analysis.  The race was reproduced on a KASAN build
> with a small module exercising this exact arm/cancel/free pattern
> (no NTB hardware available); PoC and splat are below.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103161622.1597925-1-lui2012qwq@gmail.com?part=1