Re: [BUG net] possible use after free bugs due to race condition

[Florian Westphal <fw@strlen.de>]

wkx <13514081436@163.com> wrote:
> 
> 
> Our team recently developed a vulnerability detection tool, and we have employed it to scan the Linux Kernel (version 6.9.6). After manual review, we found some potentially vulnerable code snippets, which may have use-after-free bugs due to race conditions. Therefore, we would appreciate your expert insight to confirm whether these vulnerabilities could indeed pose a risk to the system.
> 
> 1. /drivers/net/ethernet/broadcom/bcm63xx_enet.c
> 
> In bcm_enet_probe, &priv->mib_update_task is bounded with bcm_enet_update_mib_counters_defer. bcm_enet_isr_mac will be called to start the work.
> If we remove the driver which will call bcm_enet_remove to make a cleanup, there may be unfinished work.
> The possible sequence is as follows:
> CPU0                                             CPU1
>  
>                                       | bcm_enet_update_mib_counters_defer
> bcm_enet_remove        |

  unregister_netdev(dev);

... which should end up calling bcm_enet_stop() (via ops->ndo_stop in
__dev_close_many()).  This calls cancel_work_sync().

Did not look at the others.