fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
and the err_master error path of fake_init() free
fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
without calling tasklet_kill(), so a pending or running tasklet may
access already-freed memory (use-after-free).

Add tasklet_kill() before the frees in both paths.

Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yunshui Jiang <jiangyunshui@kylinos.cn>
---
 drivers/staging/vme_user/vme_fake.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vme_user/vme_fake.c b/drivers/staging/vme_user/vme_fake.c
index 8abaa3165fbb..074f0ca521ff 100644
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1226,6 +1226,7 @@ static int __init fake_init(void)
 		kfree(master_image);
 	}
 
+	tasklet_kill(&fake_device->int_tasklet);
 	kfree(fake_device);
 err_driver:
 	kfree(fake_bridge);
@@ -1283,6 +1284,8 @@ static void __exit fake_exit(void)
 		kfree(master_image);
 	}
 
+	tasklet_kill(&bridge->int_tasklet);
+
 	kfree(fake_bridge->driver_priv);
 
 	kfree(fake_bridge);
-- 
2.49.0

On Tue, Aug 11, 2026 at 05:24:59PM +0800, Yunshui Jiang wrote:
> fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
> dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
> and the err_master error path of fake_init() free
> fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
> without calling tasklet_kill(), so a pending or running tasklet may
> access already-freed memory (use-after-free).
> 
> Add tasklet_kill() before the frees in both paths.
> 
> Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
> Assisted-by: Claude-Code:GLM-5.2
> Signed-off-by: Yunshui Jiang <jiangyunshui@kylinos.cn>
> ---
>  drivers/staging/vme_user/vme_fake.c | 3 +++
>  1 file changed, 3 insertions(+)

As per:
	https://lore.kernel.org/all/2026080354-skater-urgent-31b2@gregkh/T/#u
I can not take this change, sorry.

thanks,

greg k-h