Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 8 Apr 2022 16:58:27 -0400
From:   Steven Rostedt <rostedt@goodmis.org>
To:     Thomas Gleixner <tglx@linutronix.de>
Cc:     Linus Torvalds <torvalds@linux-foundation.org>,
        LKML <linux-kernel@vger.kernel.org>, jstultz@google.com,
        Stephen Boyd <sboyd@kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Marcel Holtmann <marcel@holtmann.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
        Eric Dumazet <edumazet@google.com>,
        Guenter Roeck <linux@roeck-us.net>
Subject: Re: [RFC][PATCH] timers: Add del_time_free() to be called before
 freeing timers
Message-ID: <20220408165827.42475fb2@gandalf.local.home>
In-Reply-To: <87v8vjiaih.ffs@tglx>
References: <20220407161745.7d6754b3@gandalf.local.home>
        <87pmlrkgi3.ffs@tglx>
        <CAHk-=whbsLXy85XpKRQmBXr=GqWbMoi+wVjFY_V22=BOE=dHog@mail.gmail.com>
        <87v8vjiaih.ffs@tglx>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Fri, 08 Apr 2022 22:29:58 +0200
Thomas Gleixner <tglx@linutronix.de> wrote:

> What a shutdown function would prevent here is UAF, but I'm not entirely
> sure whether it will simplify coordinated shutdown and remove the
> requirement of a priv->shutdown flag all over the place. It might make
> some of the driver muck just get stuck in the shutdown, but that's
> definitely an improvement over a potential UAF which happens every blue
> moons.

Note, it is the cause of a large percentage of crash reports reported by
ChromeOS.

And we do not even know if it was this bluetooth issue that caused them.
There's evidence they are mostly caused by the wifi code. I only used the
bluetooth issue because it was the first one we found that looked obviously
wrong.

-- Steve