From: jiangyunshui <jiangyunshui@kylinos.cn>

fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
and the err_master error path of fake_init() free
fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
without calling tasklet_kill(), so a pending or running tasklet may
access already-freed memory (use-after-free).

Add tasklet_kill() before the frees in both paths.

Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Signed-off-by: jiangyunshui <jiangyunshui@kylinos.cn>
---
 drivers/staging/vme_user/vme_fake.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vme_user/vme_fake.c b/drivers/staging/vme_user/vme_fake.c
index 434cf760ade6..7b9d13183a41 100644
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1226,6 +1226,7 @@ static int __init fake_init(void)
 		kfree(master_image);
 	}

+	tasklet_kill(&fake_device->int_tasklet);
 	kfree(fake_device);
 err_driver:
 	kfree(fake_bridge);
@@ -1291,6 +1292,8 @@ static void __exit fake_exit(void)
 		kfree(master_image);
 	}

+	tasklet_kill(&bridge->int_tasklet);
+
 	kfree(fake_bridge->driver_priv);

 	kfree(fake_bridge);
--
2.34.1

On Tue, Aug 11, 2026 at 03:30:39PM +0800, Yunshui Jiang wrote:
> From: jiangyunshui <jiangyunshui@kylinos.cn>

Full name please, not just an email address.

> fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
> dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
> and the err_master error path of fake_init() free
> fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
> without calling tasklet_kill(), so a pending or running tasklet may
> access already-freed memory (use-after-free).

How was this found and tested?

thanks,

greg k-h

The bug was found through static code inspection of the vme_fake driver.
By reviewing the error paths in fake_init() and fake_exit(), it is evident
that tasklet_kill() is missing before kfree().

Unfortunately, I don't have a setup to trigger this specific VME
interrupt scenario dynamically. While, I think that to avoid UAF risk,
a tasklet must be explicitly killed before its associated data structure
is freed.

Changes in v2:
- Added the Assisted-by tag
- Fixed the Signed-off-by tag 
In-Reply-To: 2026081116-flounder-facing-6ef7@gregkh

fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
and the err_master error path of fake_init() free
fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
without calling tasklet_kill(), so a pending or running tasklet may
access already-freed memory (use-after-free).

Add tasklet_kill() before the frees in both paths.

Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yunshui Jiang <jiangyunshui@kylinos.cn>
---
 drivers/staging/vme_user/vme_fake.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vme_user/vme_fake.c b/drivers/staging/vme_user/vme_fake.c
index 8abaa3165fbb..074f0ca521ff 100644
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1226,6 +1226,7 @@ static int __init fake_init(void)
 		kfree(master_image);
 	}
 
+	tasklet_kill(&fake_device->int_tasklet);
 	kfree(fake_device);
 err_driver:
 	kfree(fake_bridge);
@@ -1283,6 +1284,8 @@ static void __exit fake_exit(void)
 		kfree(master_image);
 	}
 
+	tasklet_kill(&bridge->int_tasklet);
+
 	kfree(fake_bridge->driver_priv);
 
 	kfree(fake_bridge);
-- 
2.49.0

On Tue, Aug 11, 2026 at 05:24:59PM +0800, Yunshui Jiang wrote:
> fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
> dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
> and the err_master error path of fake_init() free
> fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
> without calling tasklet_kill(), so a pending or running tasklet may
> access already-freed memory (use-after-free).
> 
> Add tasklet_kill() before the frees in both paths.
> 
> Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
> Assisted-by: Claude-Code:GLM-5.2
> Signed-off-by: Yunshui Jiang <jiangyunshui@kylinos.cn>
> ---
>  drivers/staging/vme_user/vme_fake.c | 3 +++
>  1 file changed, 3 insertions(+)

As per:
	https://lore.kernel.org/all/2026080354-skater-urgent-31b2@gregkh/T/#u
I can not take this change, sorry.

thanks,

greg k-h

Unfortunately, I don't have a setup to trigger this specific VME
interrupt scenario dynamically. While, I think that to avoid UAF risk,
a tasklet must be explicitly killed before its associated data structure
is freed.

Changes in v2:
- Added the Assisted-by tag
- Fixed the Signed-off-by tag

In-Reply-To: 2026081116-flounder-facing-6ef7@gregkh

fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
and the err_master error path of fake_init() free
fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
without calling tasklet_kill(), so a pending or running tasklet may
access already-freed memory (use-after-free).

Add tasklet_kill() before the frees in both paths.

Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yunshui Jiang <jiangyunshui@kylinos.cn>
---
 drivers/staging/vme_user/vme_fake.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vme_user/vme_fake.c b/drivers/staging/vme_user/vme_fake.c
index 8abaa3165fbb..074f0ca521ff 100644
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1226,6 +1226,7 @@ static int __init fake_init(void)
 		kfree(master_image);
 	}
 
+	tasklet_kill(&fake_device->int_tasklet);
 	kfree(fake_device);
 err_driver:
 	kfree(fake_bridge);
@@ -1283,6 +1284,8 @@ static void __exit fake_exit(void)
 		kfree(master_image);
 	}
 
+	tasklet_kill(&bridge->int_tasklet);
+
 	kfree(fake_bridge->driver_priv);
 
 	kfree(fake_bridge);
-- 
2.49.0