From: Johan Hovold <johan@kernel.org>
To: Muhammad Bilal <meatuni001@gmail.com>
Cc: Ulf Hansson <ulfh@kernel.org>,
linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH] mmc: vub300: fix Use-After-Free of inactivity_timer on disconnect and probe failure
Date: Wed, 19 Aug 2026 16:46:06 +0200 [thread overview]
Message-ID: <aoXBrnq9BEsQgTJ_@hovoldconsulting.com> (raw)
In-Reply-To: <CADqcGB=ZbfAkM_90ty7=_QD3eqJd8f7urXKvTnagdv09U9RRAA@mail.gmail.com>
[ Please avoid top-posting when replying on the lists. ]
On Wed, Aug 19, 2026 at 07:33:25PM +0500, Muhammad Bilal wrote:
> You're right, thank you for catching this. I traced through
> vub300_probe() and vub300_inactivity_timer_expired() again: the
> kref_get() taken right before add_timer() is exactly the extra
> reference the timer holds, and the timer callback releases it itself
> and stops rearming once vub300->interface is NULL. So the UAF I
> described can't happen with the code as it stands.
>
> I should also be upfront that this was flagged by Sashiko, and I did
> not verify the reference counting closely enough myself before sending
> it.
Remember to mention when issues were found (or fixed) by tools like
Sashiko or LLMs generally in the commit message of any future patches as
its useful information for reviewers and maintainers (and as is also
documented as being required).
Johan
prev parent reply other threads:[~2026-08-19 14:46 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-18 21:03 Muhammad Bilal
2026-08-19 14:19 ` Johan Hovold
2026-08-19 14:33 ` Muhammad Bilal
2026-08-19 14:46 ` Johan Hovold [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aoXBrnq9BEsQgTJ_@hovoldconsulting.com \
--to=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mmc@vger.kernel.org \
--cc=meatuni001@gmail.com \
--cc=stable@vger.kernel.org \
--cc=ulfh@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®