[PATCH REPOST net] amt: fix use-after-free in AMT delayed works

[PATCH REPOST net] amt: fix use-after-free in AMT delayed works

[Shihuang Liu]

When an AMT device is removed, pending delayed works can still access
the freed amt_dev structure, which may result in kernel crashes or
memory corruption.

amt_dev_stop() cancels req_wq and discovery_wq with
cancel_delayed_work_sync(), but these works can be scheduled again
from event_wq after the cancellation. This allows delayed works to
access the freed amt_dev structure after the netdev has been released.

The following is a simple race scenario:

CPU0                         CPU1

amt_dev_stop()
cancel_delayed_work_sync()
                             amt_event_work()
                             mod_delayed_work(req_wq)
free netdev
                             req_wq accesses freed amt_dev

Use disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and
discovery_wq from being queued again and wait for running work items
to complete.

The delayed works are disabled after initialization in
amt_newlink() and enabled only when the device is successfully opened.
This keeps the delayed work lifecycle synchronized with the lifetime
of the AMT device.

Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
Cc: stable@vger.kernel.org
Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
---
Repost:
  - Explicitly target the net tree.
  - Add Reviewed-by from Simon Horman.

Previous submission:
  https://lore.kernel.org/netdev/20260714072705.129262-1-shlomojune6@gmail.com/

 drivers/net/amt.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index 951dd10e192b..7eb871b9b7e1 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -2995,9 +2995,15 @@ static int amt_dev_open(struct net_device *dev)
 	amt->event_idx = 0;
 	amt->nr_events = 0;
 
+	enable_delayed_work(&amt->discovery_wq);
+	enable_delayed_work(&amt->req_wq);
+
 	err = amt_socket_create(amt);
-	if (err)
+	if (err) {
+		disable_delayed_work(&amt->req_wq);
+		disable_delayed_work(&amt->discovery_wq);
 		return err;
+	}
 
 	amt->req_cnt = 0;
 	amt->remote_ip = 0;
@@ -3023,8 +3029,8 @@ static int amt_dev_stop(struct net_device *dev)
 	struct sock *sk;
 	int i;
 
-	cancel_delayed_work_sync(&amt->req_wq);
-	cancel_delayed_work_sync(&amt->discovery_wq);
+	disable_delayed_work_sync(&amt->req_wq);
+	disable_delayed_work_sync(&amt->discovery_wq);
 	cancel_delayed_work_sync(&amt->secret_wq);
 
 	/* shutdown */
@@ -3278,6 +3284,8 @@ static int amt_newlink(struct net_device *dev,
 	INIT_DELAYED_WORK(&amt->req_wq, amt_req_work);
 	INIT_DELAYED_WORK(&amt->secret_wq, amt_secret_work);
 	INIT_WORK(&amt->event_wq, amt_event_work);
+	disable_delayed_work(&amt->req_wq);
+	disable_delayed_work(&amt->discovery_wq);
 	INIT_LIST_HEAD(&amt->tunnel_list);
 	return 0;
 err:

base-commit: ba712ecfd942b68b21a4b0a5daaf72f6616cc66d
-- 
2.43.0

Re: [PATCH REPOST net] amt: fix use-after-free in AMT delayed works

[Taehee Yoo]

On Wed, Jul 22, 2026 at 8:39 PM Shihuang Liu <shlomojune6@gmail.com> wrote:
>

Hi Shihuang Liu,
Thanks a lot for your work!

> When an AMT device is removed, pending delayed works can still access
> the freed amt_dev structure, which may result in kernel crashes or
> memory corruption.
>
> amt_dev_stop() cancels req_wq and discovery_wq with
> cancel_delayed_work_sync(), but these works can be scheduled again
> from event_wq after the cancellation. This allows delayed works to
> access the freed amt_dev structure after the netdev has been released.
>
> The following is a simple race scenario:
>
> CPU0                         CPU1
>
> amt_dev_stop()
> cancel_delayed_work_sync()
>                              amt_event_work()
>                              mod_delayed_work(req_wq)
> free netdev
>                              req_wq accesses freed amt_dev
>
> Use disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and
> discovery_wq from being queued again and wait for running work items
> to complete.
>
> The delayed works are disabled after initialization in
> amt_newlink() and enabled only when the device is successfully opened.
> This keeps the delayed work lifecycle synchronized with the lifetime
> of the AMT device.
>
> Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shihuang Liu <shlomojune6@gmail.com>
> Reviewed-by: Simon Horman <horms@kernel.org>

Reviewed-by: Taehee Yoo <ap420073@gmail.com>

Thanks a lot!
Taehee Yoo

> ---
> Repost:
>   - Explicitly target the net tree.
>   - Add Reviewed-by from Simon Horman.
>
> Previous submission:
>   https://lore.kernel.org/netdev/20260714072705.129262-1-shlomojune6@gmail.com/
>
>  drivers/net/amt.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/amt.c b/drivers/net/amt.c
> index 951dd10e192b..7eb871b9b7e1 100644
> --- a/drivers/net/amt.c
> +++ b/drivers/net/amt.c
> @@ -2995,9 +2995,15 @@ static int amt_dev_open(struct net_device *dev)
>         amt->event_idx = 0;
>         amt->nr_events = 0;
>
> +       enable_delayed_work(&amt->discovery_wq);
> +       enable_delayed_work(&amt->req_wq);
> +
>         err = amt_socket_create(amt);
> -       if (err)
> +       if (err) {
> +               disable_delayed_work(&amt->req_wq);
> +               disable_delayed_work(&amt->discovery_wq);
>                 return err;
> +       }
>
>         amt->req_cnt = 0;
>         amt->remote_ip = 0;
> @@ -3023,8 +3029,8 @@ static int amt_dev_stop(struct net_device *dev)
>         struct sock *sk;
>         int i;
>
> -       cancel_delayed_work_sync(&amt->req_wq);
> -       cancel_delayed_work_sync(&amt->discovery_wq);
> +       disable_delayed_work_sync(&amt->req_wq);
> +       disable_delayed_work_sync(&amt->discovery_wq);
>         cancel_delayed_work_sync(&amt->secret_wq);
>
>         /* shutdown */
> @@ -3278,6 +3284,8 @@ static int amt_newlink(struct net_device *dev,
>         INIT_DELAYED_WORK(&amt->req_wq, amt_req_work);
>         INIT_DELAYED_WORK(&amt->secret_wq, amt_secret_work);
>         INIT_WORK(&amt->event_wq, amt_event_work);
> +       disable_delayed_work(&amt->req_wq);
> +       disable_delayed_work(&amt->discovery_wq);
>         INIT_LIST_HEAD(&amt->tunnel_list);
>         return 0;
>  err:
>
> base-commit: ba712ecfd942b68b21a4b0a5daaf72f6616cc66d
> --
> 2.43.0

Re: [PATCH REPOST net] amt: fix use-after-free in AMT delayed works

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 22 Jul 2026 19:39:19 +0800 you wrote:
> When an AMT device is removed, pending delayed works can still access
> the freed amt_dev structure, which may result in kernel crashes or
> memory corruption.
> 
> amt_dev_stop() cancels req_wq and discovery_wq with
> cancel_delayed_work_sync(), but these works can be scheduled again
> from event_wq after the cancellation. This allows delayed works to
> access the freed amt_dev structure after the netdev has been released.
> 
> [...]

Here is the summary with links:
  - [REPOST,net] amt: fix use-after-free in AMT delayed works
    https://git.kernel.org/netdev/net/c/ea20c44935d6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html