[PATCH v5] net/ncsi: Fix Use-After-Free in NCSI teardown using synchronize_rcu

[Wong Boon Jhee <wongboonjhee52@gmail.com>]

ncsi_remove_package() and ncsi_remove_channel() remove objects from
RCU-protected lists and free them immediately using kfree(). Concurrent
readers (such as Netlink dump handlers) traversing these lists may
access freed memory, resulting in a slab-use-after-free.

Instead of converting all frees to kfree_rcu() or adding complex
reference counting, this fix uses synchronize_rcu() and rcu_barrier()
in the teardown path (ncsi_unregister_dev). By stopping asynchronous
producers and waiting for all RCU readers to finish before destroying
the device tree, we ensure safe synchronous reclamation.

This approach is compact, avoids overhead on the fast path, and
resolves the race condition reported by KASAN.

Fixes: 2d283bdd079c ("net/ncsi: Resource management")
Signed-off-by: Wong Boon Jhee <wongboonjhee52@gmail.com>
---
v4 -> v5:
- Adopted maintainer's suggestion to use synchronize_rcu()/rcu_barrier()
  in ncsi_unregister_dev() for a compact teardown fix.
- Removed complex kref/dev_hold lifecycle changes.
- Simplified the patch to focus strictly on flushing readers during
  device unregistration.

 net/ncsi/ncsi-manage.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
index 54d0df0a9efe..3cda4b28480f 100644
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -1956,19 +1956,33 @@ void ncsi_unregister_dev(struct ncsi_dev *nd)
 {
 	struct ncsi_dev_priv *ndp = TO_NCSI_DEV_PRIV(nd);
 	struct ncsi_package *np, *tmp;
+	struct ncsi_channel *nc;
 	unsigned long flags;
-
-	dev_remove_pack(&ndp->ptype);
-
-	list_for_each_entry_safe(np, tmp, &ndp->packages, node)
-		ncsi_remove_package(np);
+	int i;
 
 	spin_lock_irqsave(&ncsi_dev_lock, flags);
 	list_del_rcu(&ndp->node);
 	spin_unlock_irqrestore(&ncsi_dev_lock, flags);
 
+	dev_remove_pack(&ndp->ptype);
 	disable_work_sync(&ndp->work);
 
+	for (i = 0; i < ARRAY_SIZE(ndp->requests); i++) {
+		if (ndp->requests[i].enabled)
+			timer_delete_sync(&ndp->requests[i].timer);
+	}
+
+	list_for_each_entry(np, &ndp->packages, node) {
+		list_for_each_entry(nc, &np->channels, node)
+			ncsi_stop_channel_monitor(nc);
+	}
+
+	synchronize_rcu();
+	rcu_barrier();
+
+	list_for_each_entry_safe(np, tmp, &ndp->packages, node)
+		ncsi_remove_package(np);
+
 	kfree(ndp);
 }
 EXPORT_SYMBOL_GPL(ncsi_unregister_dev);
-- 
2.55.0