[PATCH net v3 5/5] gve: Fix UAF due to stats report race with teardown

[Pin-yen Lin <treapking@google.com>]

While stats_report_timer is deleted during queue stop and teardown, the
corresponding stats_report_task work item is not explicitly cancelled.

This issue was identified by static analysis and code review via Sashiko
during review of earlier revisions. The race condition is purely
theoretical and was not observed triggering a crash in practice.

This leads to the following issues:
1. During queue stop: stats_report_task can still be pending after
   stats_report_timer is deleted and run after queues are stopped.
2. During teardown/reset/suspend: if stats_report_task was queued by
   the timer, freeing priv->stats_report in
   gve_free_stats_report() without cancelling the work item can cause a
   NULL pointer dereference or UAF on priv->stats_report when
   gve_stats_report_task() runs.

Fix this by calling cancel_work_sync(&priv->stats_report_task) after
timer_delete_sync() in both gve_queues_stop() and gve_free_stats_report().

The change is theoretical and was not tested on real hardware.

Link: https://sashiko.dev/#/patchset/20260425002450.163421-1-hramamurthy%40google.com?part=1
Cc: stable@vger.kernel.org
Fixes: 24aeb56f2d38 ("gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.")
Signed-off-by: Pin-yen Lin <treapking@google.com>
---

Changes in v3:
- New in v3

 drivers/net/ethernet/google/gve/gve_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index f1eb0c6e1f9b..28624ded5f3b 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -350,6 +350,7 @@ static void gve_free_stats_report(struct gve_priv *priv)
 		return;
 
 	timer_delete_sync(&priv->stats_report_timer);
+	cancel_work_sync(&priv->stats_report_task);
 	dma_free_coherent(&priv->pdev->dev, priv->stats_report_len,
 			  priv->stats_report, priv->stats_report_bus);
 	priv->stats_report = NULL;
@@ -1593,6 +1594,7 @@ static int gve_queues_stop(struct gve_priv *priv)
 		gve_clear_device_rings_ok(priv);
 	}
 	timer_delete_sync(&priv->stats_report_timer);
+	cancel_work_sync(&priv->stats_report_task);
 
 	gve_unreg_xdp_info(priv);
 
-- 
2.56.0.385.gd3acb90ef8-goog