Re: [PATCH net-next 1/3] rose: fix race between loopback timer and module removal

On Mon, Apr 13, 2026 at 07:42:36PM +0200, f6bvp wrote:
> rose_loopback_clear() used timer_delete() which returns immediately
> without waiting for any running callback to complete.  If the timer
> fired concurrently with module removal, rose_loopback_timer() would
> access rose_loopback_neigh after it was freed, causing a use-after-free.
> 
> Three changes fix the race:
> 
> 1. Add a loopback_stopping atomic flag.  rose_loopback_timer() checks
>    this at entry and mid-loop; when set it drains the queue and bails
>    out without re-arming the timer.
> 
> 2. Switch rose_loopback_clear() to timer_delete_sync() so it blocks
>    until any in-flight callback has returned.
> 
> 3. Wrap the timer body with rose_neigh_hold()/rose_neigh_put() so the
>    loopback neighbour cannot be freed while the callback is running.
> 
> Also fix a pre-existing bug: dev_put(dev) was only called on the
> failure path of rose_rx_call_request(); it is now called unconditionally
> so the device reference is always released.

Hi Barnard

Thanks for the patches.

A few process points.

We prefer lots of small patches, with good commit messages, which are
obviously correct. When i see a list like this, it makes me think the
patch can be split up into smaller patches.

When you have a patch series, please include a patch 0/X which
explains the big picture.

net-next is current closed for the merge window. You can post patches
as RFC, but don't post anything expecting it to be merged.

There is more information here:

https://www.kernel.org/doc/html/latest/process/maintainer-netdev.html

	Andrew