Re: [PATCH net v2 0/2] s390/ctcm: Fix timer bugs in fsm.c

[Jakub Kicinski <kuba@kernel.org>]

On Wed, 16 Sep 2026 15:21:47 +0200 Nagamani PV wrote:
> Fix two bugs in drivers/s390/net/fsm.c found by Sashiko AI code review.
> 
> Patch 1 fixes timer list corruption when fsm_addtimer() is called on
> an already-pending timer - timer_setup() re-initializes the timer
> list_head while it is still enqueued in the wheel.
> 
> Patch 2 fixes a use-after-free in channel_remove() - timer_delete()
> returns before any running callback finishes, leaving a window where
> the timer callback can access freed memory. Fix by waiting for any
> running callback to complete before freeing the channel.
> 
> Changes in v2:
> - Patch 1: fix function name ctcm_send_sweep() -> ctcmpc_send_sweep_req()
>   in the commit message (Sashiko netdev-bot)
> - Patch 1: call mod_timer() then return 0 explicitly, preserving the
>   "Always returns 0" contract documented in fsm.h (Sashiko netdev-bot)
> - Patch 2: add Fixes: and Cc: stable@vger.kernel.org tags
>   (Sashiko netdev-bot)

Clashiko won't respond because of the unnecessary threading,
but there are 4 high severity findings needing your attention:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260916132149.4185912-3-nagamani@linux.ibm.com
-- 
pw-bot: cr