atm: fore200e: fix use-after-free in tasklets during device removal

In the Linux kernel, the following vulnerability has been resolved:

atm: fore200e: fix use-after-free in tasklets during device removal

When the PCA-200E or SBA-200E adapter is being detached, the fore200e

is deallocated. However, the tx_tasklet or rx_tasklet may still be running

or pending, leading to use-after-free bug when the already freed fore200e

is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().

One of the race conditions can occur as follows:

CPU 0 (cleanup) | CPU 1 (tasklet)

fore200e_pca_remove_one() | fore200e_interrupt()

fore200e_shutdown() | tasklet_schedule()

kfree(fore200e) | fore200e_tx_tasklet()

| fore200e-> // UAF

Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before

the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to

synchronize with any pending or running tasklets. Moreover, since

fore200e_reset() could prevent further interrupts or data transfers,

the tasklet_kill() should be placed after fore200e_reset() to prevent

the tasklet from being rescheduled in fore200e_interrupt(). Finally,

it only needs to do tasklet_kill() when the fore200e state is greater

than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized

in earlier states. In a word, the tasklet_kill() should be placed in

the FORE200E_STATE_IRQ branch within the switch...case structure.

This bug was identified through static analysis.