[PATCH net v4] atm: fore200e: fix use-after-free in tasklets during device removal

[PATCH net v4] atm: fore200e: fix use-after-free in tasklets during device removal

[Duoming Zhou]

When the PCA-200E or SBA-200E adapter is being detached, the fore200e
is deallocated. However, the tx_tasklet or rx_tasklet may still be running
or pending, leading to use-after-free bug when the already freed fore200e
is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().

One of the race conditions can occur as follows:

CPU 0 (cleanup)           | CPU 1 (tasklet)
fore200e_pca_remove_one() | fore200e_interrupt()
  fore200e_shutdown()     |   tasklet_schedule()
    kfree(fore200e)       | fore200e_tx_tasklet()
                          |   fore200e-> // UAF

Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before
the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to
synchronize with any pending or running tasklets. Moreover, since
fore200e_reset() could prevent further interrupts or data transfers,
the tasklet_kill() should be placed after fore200e_reset() to prevent
the tasklet from being rescheduled in fore200e_interrupt(). Finally,
it only needs to do tasklet_kill() when the fore200e state is greater
than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized
in earlier states. In a word, the tasklet_kill() should be placed in
the FORE200E_STATE_IRQ branch within the switch...case structure.

This bug was identified through static analysis.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@kernel.org
Suggested-by: Jijie Shao <shaojijie@huawei.com>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Jijie Shao <shaojijie@huawei.com>
---
Changes in v4:
  - Do tasklet_kill() in "switch(fore200e->state)-case FORE200E_STATE_IRQ" branch.
  - Make the commit messages clearer.

 drivers/atm/fore200e.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index f62e3857144..fec081db36d 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -373,6 +373,10 @@ fore200e_shutdown(struct fore200e* fore200e)
 	fallthrough;
     case FORE200E_STATE_IRQ:
 	free_irq(fore200e->irq, fore200e->atm_dev);
+#ifdef FORE200E_USE_TASKLET
+	tasklet_kill(&fore200e->tx_tasklet);
+	tasklet_kill(&fore200e->rx_tasklet);
+#endif
 
 	fallthrough;
     case FORE200E_STATE_ALLOC_BUF:
-- 
2.34.1

Re: [PATCH net v4] atm: fore200e: fix use-after-free in tasklets during device removal

[Simon Horman]

On Tue, Feb 10, 2026 at 05:45:37PM +0800, Duoming Zhou wrote:
> When the PCA-200E or SBA-200E adapter is being detached, the fore200e
> is deallocated. However, the tx_tasklet or rx_tasklet may still be running
> or pending, leading to use-after-free bug when the already freed fore200e
> is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().
> 
> One of the race conditions can occur as follows:
> 
> CPU 0 (cleanup)           | CPU 1 (tasklet)
> fore200e_pca_remove_one() | fore200e_interrupt()
>   fore200e_shutdown()     |   tasklet_schedule()
>     kfree(fore200e)       | fore200e_tx_tasklet()
>                           |   fore200e-> // UAF
> 
> Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before
> the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to
> synchronize with any pending or running tasklets. Moreover, since
> fore200e_reset() could prevent further interrupts or data transfers,
> the tasklet_kill() should be placed after fore200e_reset() to prevent
> the tasklet from being rescheduled in fore200e_interrupt(). Finally,
> it only needs to do tasklet_kill() when the fore200e state is greater
> than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized
> in earlier states. In a word, the tasklet_kill() should be placed in
> the FORE200E_STATE_IRQ branch within the switch...case structure.
> 
> This bug was identified through static analysis.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@kernel.org
> Suggested-by: Jijie Shao <shaojijie@huawei.com>
> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> Reviewed-by: Jijie Shao <shaojijie@huawei.com>
> ---
> Changes in v4:
>   - Do tasklet_kill() in "switch(fore200e->state)-case FORE200E_STATE_IRQ" branch.
>   - Make the commit messages clearer.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net v4] atm: fore200e: fix use-after-free in tasklets during device removal

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 10 Feb 2026 17:45:37 +0800 you wrote:
> When the PCA-200E or SBA-200E adapter is being detached, the fore200e
> is deallocated. However, the tx_tasklet or rx_tasklet may still be running
> or pending, leading to use-after-free bug when the already freed fore200e
> is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().
> 
> One of the race conditions can occur as follows:
> 
> [...]

Here is the summary with links:
  - [net,v4] atm: fore200e: fix use-after-free in tasklets during device removal
    https://git.kernel.org/netdev/net/c/8930878101cd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html