[PATCH] staging: vme_user: kill fake VIRQ tasklet on exit

[Jiale Yao]

fake_irq_generate() schedules int_tasklet, which is embedded in struct
fake_driver and receives fake_bridge as its data argument. fake_exit()
frees both objects without waiting for a pending tasklet to complete.

This was reproduced on v6.18.52 under QEMU with the following sequence:

  1. Load vme_fake and vme_user to create /dev/bus/vme/ctl.
  2. Issue VME_IRQ_GEN ioctls so fake_irq_generate() queues int_tasklet.
  3. Concurrently unload vme_fake before ksoftirqd runs the tasklet.
  4. fake_exit() frees the embedded tasklet and fake_bridge, after which
     tasklet_action_common() accesses the freed tasklet.

KASAN reported:

  BUG: KASAN: slab-use-after-free in tasklet_action_common+0xee/0x6f0
  Read of size 8 by task ksoftirqd/3/36

  Call Trace:
   <TASK>
   dump_stack_lvl+0x48/0x120
   print_report+0x191/0x580
   kasan_report+0x139/0x170
   tasklet_action_common+0xee/0x6f0
   handle_softirqs+0x159/0x4c0
   run_ksoftirqd+0x1c/0x30
   smpboot_thread_fn+0x385/0x700
   kthread+0x5c6/0x730
   ret_from_fork+0x15a/0x380
   ret_from_fork_asm+0x1a/0x30
   </TASK>

Unregister the bridge to remove the userspace entry point, then kill the
tasklet before tearing down the bridge resources. This ensures any pending
callback has completed before its storage and data argument are freed.

Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Assisted-by: Codex:gpt-5.6-terra
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/staging/vme_user/vme_fake.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/vme_user/vme_fake.c b/drivers/staging/vme_user/vme_fake.c
index d0e7ba204c3e..451415a7ce1c 100644
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1267,6 +1267,7 @@ static void __exit fake_exit(void)
 	bridge->lm_enabled = 0;
 
 	vme_unregister_bridge(fake_bridge);
+	tasklet_kill(&bridge->int_tasklet);
 
 	fake_crcsr_exit(fake_bridge);
 	/* resources are stored in link list */
-- 
2.34.1