Re: [PATCH net 1/2] hdlc_cisco: shut down the keepalive timer on ->detach

[Simon Horman <horms@kernel.org>]

On Wed, Oct 28, 2026 at 11:23:09AM +0800, Chengyu Liu wrote:
> cisco_start() arms st->timer unconditionally and cisco_timer() re-arms
> itself on every fire.  The only deletion lives in cisco_stop(), which is
> unreachable on the protocol-detach path: detach_hdlc_protocol() calls
> only ->detach() (never ->stop()) and then kfree()s hdlc->state.  The
> cisco hdlc_proto has no ->detach at all, so unregistering an up cisco
> device leaves the keepalive timer armed on top of freed memory; it fires
> within one keepalive interval and cisco_timer() writes through the dead
> cisco_state (st->lock, st->txseq++, cisco_keepalive_send()).
> 
> Add a ->detach callback that shuts the timer down permanently before the
> state is freed, mirroring the CVE-2026-63803 ppp fix
> (timer_shutdown_sync() in ppp_timer_release()).
> 
> Initialize the timer in cisco_ioctl() when the protocol is attached and
> drop the timer_setup() from cisco_start(), so the timer is initialized
> exactly once at attach time: attach_hdlc_protocol() uses kmalloc() (not
> kzalloc), so st->timer is uninitialized garbage until the first
> timer_setup() and ->detach() must never run timer_shutdown_sync() on it.
> 
> This bug was found by static analysis and confirmed with a KASAN
> reproducer: slab-use-after-free write in __run_timer_base() within one
> keepalive interval after rmmod of an up cisco HDLC device (allocated by
> attach_hdlc_protocol() via cisco_ioctl(), freed by
> detach_hdlc_protocol() via unregister_hdlc_device()).
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengyu Liu <19290937@qq.com>

Reviewed-by: Simon Horman <horms@kernel.org>

...