Re: [PATCH v2 14/14] NTB: ntb_transport: Remove clients before freeing transport resources

[Logan Gunthorpe]

On 2026-09-09 22:08, Koichiro Den wrote:
> Unbinding ntb_transport can call ntb_transport_free() while ntb_netdev
> is still bound. The transport frees MWs and QP resources before
> unregistering the clients, so the netdev's transmit path and timer can
> access freed memory. Its remove callback also calls
> ntb_transport_free_queue() on a QP whose resources have already been
> released. This teardown order is unsafe and somewhat unintuitive.
> 
> The crash can be reproduced with an intensive TX load, during which you
> unbind the NTB device. The following is a KASAN report from my
> VHOST/HOST setup using vNTB.
> 
>   VHOST# sudo iperf3 -ub0 -c $HOST -l 100 -P 100 &
>   VHOST# echo $VHOST_NTB_DEV > /sys/bus/ntb/drivers/ntb_transport/unbind
> 
>   ==================================================================
>   BUG: KASAN: vmalloc-out-of-bounds in ntb_transport_tx_free_entry+0xf0
>   ...
>   Call trace:
>    ...
>    __asan_report_load4_noabort+0x1c/0x30
>    ntb_transport_tx_free_entry+0xf0/0x130 [ntb_transport]
>    ntb_netdev_tx_timer+0x78/0x260 [ntb_netdev]
>    ...
> 
> Disable and drain transport link work first, then unregister the clients
> so they stop using and release their QPs. After that, free any QPs left
> over before running transport link cleanup. Disabling the work keeps
> link events from restarting setup or cleanup during client removal.
> 
> Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Koichiro Den <den@xxxxxxxxxxxxx>

Looks good to me.

Reviewed-by: Logan Gunthorpe <logang@xxxxxxxxxxxx>