Re: [RFC][PATCH] timers: Add del_time_free() to be called before freeing timers

From: Thomas Gleixner <tglx@linutronix.de>
To: Steven Rostedt <rostedt@goodmis.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
	LKML <linux-kernel@vger.kernel.org>,
	jstultz@google.com, Stephen Boyd <sboyd@kernel.org>,
	Andrew Morton <akpm@linux-foundation.org>,
	Peter Zijlstra <peterz@infradead.org>,
	Marcel Holtmann <marcel@holtmann.org>,
	Johan Hedberg <johan.hedberg@gmail.com>,
	Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
	Eric Dumazet <edumazet@google.com>,
	Guenter Roeck <linux@roeck-us.net>
Subject: Re: [RFC][PATCH] timers: Add del_time_free() to be called before freeing timers
Date: Fri, 08 Apr 2022 23:46:34 +0200	[thread overview]
Message-ID: <87pmlri6yt.ffs@tglx> (raw)
In-Reply-To: <20220408165827.42475fb2@gandalf.local.home>

On Fri, Apr 08 2022 at 16:58, Steven Rostedt wrote:

> On Fri, 08 Apr 2022 22:29:58 +0200
> Thomas Gleixner <tglx@linutronix.de> wrote:
>
>> What a shutdown function would prevent here is UAF, but I'm not entirely
>> sure whether it will simplify coordinated shutdown and remove the
>> requirement of a priv->shutdown flag all over the place. It might make
>> some of the driver muck just get stuck in the shutdown, but that's
>> definitely an improvement over a potential UAF which happens every blue
>> moons.
>
> Note, it is the cause of a large percentage of crash reports reported by
> ChromeOS.
>
> And we do not even know if it was this bluetooth issue that caused them.
> There's evidence they are mostly caused by the wifi code. I only used the
> bluetooth issue because it was the first one we found that looked obviously
> wrong.

I'm sure that there are hundres more...