* [PATCH] staging: vme_user: fake: stop tasklet before freeing its data
@ 2026-08-11 7:30 Yunshui Jiang
2026-08-11 7:51 ` Greg KH
0 siblings, 1 reply; 6+ messages in thread
From: Yunshui Jiang @ 2026-08-11 7:30 UTC (permalink / raw)
To: linux-kernel, linux-staging; +Cc: gregkh, martyn, kees, jiangyunshui
From: jiangyunshui <jiangyunshui@kylinos.cn>
fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
and the err_master error path of fake_init() free
fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
without calling tasklet_kill(), so a pending or running tasklet may
access already-freed memory (use-after-free).
Add tasklet_kill() before the frees in both paths.
Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Signed-off-by: jiangyunshui <jiangyunshui@kylinos.cn>
---
drivers/staging/vme_user/vme_fake.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/staging/vme_user/vme_fake.c b/drivers/staging/vme_user/vme_fake.c
index 434cf760ade6..7b9d13183a41 100644
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1226,6 +1226,7 @@ static int __init fake_init(void)
kfree(master_image);
}
+ tasklet_kill(&fake_device->int_tasklet);
kfree(fake_device);
err_driver:
kfree(fake_bridge);
@@ -1291,6 +1292,8 @@ static void __exit fake_exit(void)
kfree(master_image);
}
+ tasklet_kill(&bridge->int_tasklet);
+
kfree(fake_bridge->driver_priv);
kfree(fake_bridge);
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] staging: vme_user: fake: stop tasklet before freeing its data
2026-08-11 7:30 [PATCH] staging: vme_user: fake: stop tasklet before freeing its data Yunshui Jiang
@ 2026-08-11 7:51 ` Greg KH
2026-08-11 9:18 ` [PATCH v2] " Yunshui Jiang
2026-08-11 9:24 ` Yunshui Jiang
0 siblings, 2 replies; 6+ messages in thread
From: Greg KH @ 2026-08-11 7:51 UTC (permalink / raw)
To: Yunshui Jiang; +Cc: linux-kernel, linux-staging, martyn, kees
On Tue, Aug 11, 2026 at 03:30:39PM +0800, Yunshui Jiang wrote:
> From: jiangyunshui <jiangyunshui@kylinos.cn>
Full name please, not just an email address.
> fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
> dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
> and the err_master error path of fake_init() free
> fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
> without calling tasklet_kill(), so a pending or running tasklet may
> access already-freed memory (use-after-free).
How was this found and tested?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] staging: vme_user: fake: stop tasklet before freeing its data
2026-08-11 7:51 ` Greg KH
@ 2026-08-11 9:18 ` Yunshui Jiang
2026-08-11 9:18 ` Yunshui Jiang
2026-08-11 9:24 ` Yunshui Jiang
1 sibling, 1 reply; 6+ messages in thread
From: Yunshui Jiang @ 2026-08-11 9:18 UTC (permalink / raw)
To: gregkh; +Cc: kees, linux-kernel, linux-staging, martyn, jiangyunshui
Unfortunately, I don't have a setup to trigger this specific VME
interrupt scenario dynamically. While, I think that to avoid UAF risk,
a tasklet must be explicitly killed before its associated data structure
is freed.
Changes in v2:
- Added the Assisted-by tag
- Fixed the Signed-off-by tag
In-Reply-To: 2026081116-flounder-facing-6ef7@gregkh
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] staging: vme_user: fake: stop tasklet before freeing its data
2026-08-11 9:18 ` [PATCH v2] " Yunshui Jiang
@ 2026-08-11 9:18 ` Yunshui Jiang
0 siblings, 0 replies; 6+ messages in thread
From: Yunshui Jiang @ 2026-08-11 9:18 UTC (permalink / raw)
To: gregkh; +Cc: kees, linux-kernel, linux-staging, martyn, jiangyunshui
fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
and the err_master error path of fake_init() free
fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
without calling tasklet_kill(), so a pending or running tasklet may
access already-freed memory (use-after-free).
Add tasklet_kill() before the frees in both paths.
Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yunshui Jiang <jiangyunshui@kylinos.cn>
---
drivers/staging/vme_user/vme_fake.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/staging/vme_user/vme_fake.c b/drivers/staging/vme_user/vme_fake.c
index 8abaa3165fbb..074f0ca521ff 100644
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1226,6 +1226,7 @@ static int __init fake_init(void)
kfree(master_image);
}
+ tasklet_kill(&fake_device->int_tasklet);
kfree(fake_device);
err_driver:
kfree(fake_bridge);
@@ -1283,6 +1284,8 @@ static void __exit fake_exit(void)
kfree(master_image);
}
+ tasklet_kill(&bridge->int_tasklet);
+
kfree(fake_bridge->driver_priv);
kfree(fake_bridge);
--
2.49.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v2] staging: vme_user: fake: stop tasklet before freeing its data
2026-08-11 7:51 ` Greg KH
2026-08-11 9:18 ` [PATCH v2] " Yunshui Jiang
@ 2026-08-11 9:24 ` Yunshui Jiang
2026-08-11 9:24 ` Yunshui Jiang
1 sibling, 1 reply; 6+ messages in thread
From: Yunshui Jiang @ 2026-08-11 9:24 UTC (permalink / raw)
To: gregkh; +Cc: kees, linux-kernel, linux-staging, martyn, jiangyunshui
The bug was found through static code inspection of the vme_fake driver.
By reviewing the error paths in fake_init() and fake_exit(), it is evident
that tasklet_kill() is missing before kfree().
Unfortunately, I don't have a setup to trigger this specific VME
interrupt scenario dynamically. While, I think that to avoid UAF risk,
a tasklet must be explicitly killed before its associated data structure
is freed.
Changes in v2:
- Added the Assisted-by tag
- Fixed the Signed-off-by tag
In-Reply-To: 2026081116-flounder-facing-6ef7@gregkh
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] staging: vme_user: fake: stop tasklet before freeing its data
2026-08-11 9:24 ` Yunshui Jiang
@ 2026-08-11 9:24 ` Yunshui Jiang
0 siblings, 0 replies; 6+ messages in thread
From: Yunshui Jiang @ 2026-08-11 9:24 UTC (permalink / raw)
To: gregkh; +Cc: kees, linux-kernel, linux-staging, martyn, jiangyunshui
fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
and the err_master error path of fake_init() free
fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
without calling tasklet_kill(), so a pending or running tasklet may
access already-freed memory (use-after-free).
Add tasklet_kill() before the frees in both paths.
Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yunshui Jiang <jiangyunshui@kylinos.cn>
---
drivers/staging/vme_user/vme_fake.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/staging/vme_user/vme_fake.c b/drivers/staging/vme_user/vme_fake.c
index 8abaa3165fbb..074f0ca521ff 100644
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1226,6 +1226,7 @@ static int __init fake_init(void)
kfree(master_image);
}
+ tasklet_kill(&fake_device->int_tasklet);
kfree(fake_device);
err_driver:
kfree(fake_bridge);
@@ -1283,6 +1284,8 @@ static void __exit fake_exit(void)
kfree(master_image);
}
+ tasklet_kill(&bridge->int_tasklet);
+
kfree(fake_bridge->driver_priv);
kfree(fake_bridge);
--
2.49.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-11 9:26 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-11 7:30 [PATCH] staging: vme_user: fake: stop tasklet before freeing its data Yunshui Jiang
2026-08-11 7:51 ` Greg KH
2026-08-11 9:18 ` [PATCH v2] " Yunshui Jiang
2026-08-11 9:18 ` Yunshui Jiang
2026-08-11 9:24 ` Yunshui Jiang
2026-08-11 9:24 ` Yunshui Jiang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox