Re: [PATCH] mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

在 2026/8/8 01:23, Aubin Constans 写道:
> On 03/08/2026 11:48, Pei Xiao wrote:
> 
>> In atmci_probe, &host->bh_work is bound with atmci_work_func, and>
> atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all
>> queue this work on system_bh_wq.
>>
>> If we remove the module, atmci_remove makes cleanup and the memory
>> allocated for host with devm_kzalloc() is released after the remove
>> callback returns, while the work mentioned above may still be pending
>> or running. The sequence of operations that may lead to a UAF bug is
>> as follows:
> 
> Thank you for having spotted the issue, and sent this fix.
>  >
>> CPU0                                      CPU1
>>
>>                                            | atmci_interrupt
>>                                            | queue_work(system_bh_wq,
>>                                            |            &host->bh_work)
>> atmci_remove                              |
>> atmci_cleanup_slot(...)                   |
>> atmci_writel(host, ATMCI_IDR, ~0UL)       |
>> timer_delete_sync(&host->timer)           |
>> dma_release_channel(host->dma.chan)       |
>> free_irq(platform_get_irq(pdev, 0), host) |
>>                                            | atmci_work_func
>>                                            | // use host
>> // devm resources released after          |
>> // remove returns, host is freed          |
>>                                            | // use host (use-after-free)
>>
>> Fix it by canceling the work after all the sources that can schedule
>> it (IRQ handler, timeout timer and DMA completion callback) have been
>> stopped, and before proceeding with the remaining cleanup in
>> atmci_remove.
> 
> For completeness, PDC completion could be added to the above list of
> sources,
> even though it is a subroutine of the IRQ handler.
Yes.I used an IRQ handler instead here.
> PDC and DMA are exclusive.

> 
> Mentioning on which board or MPU the patch was tested would also be a
> welcome
> addition.
Sorry, I don't have hardware testing here; I found this issue through
static analysis.

Thanks!
Pei.
> 
>>
>> Fixes: 7d2be0749a59 ("atmel-mci: Driver for Atmel on-chip MMC
>> controllers")
>> Assisted-by: Codex:deepseek-v4-flash
>> Signed-off-by: Pei Xiao <[email protected]>
>> ---
>>   drivers/mmc/host/atmel-mci.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
>> index 3b4928f5b9b2..8f4df250a77a 100644
>> --- a/drivers/mmc/host/atmel-mci.c
>> +++ b/drivers/mmc/host/atmel-mci.c
>> @@ -2610,6 +2610,8 @@ static void atmci_remove(struct platform_device
>> *pdev)
>>
>>          free_irq(platform_get_irq(pdev, 0), host);
>>
>> +       cancel_work_sync(&host->bh_work);
>> +
>>          clk_disable_unprepare(host->mck);
>>
>>          pm_runtime_disable(dev);
>> -- 
>> 2.25.1
>>