Re: [PATCH v8 0/3] MR4243: rtworkq: free cancelled work items

[Yuxuan Shui (＠yshui)]

On Wed Mar  6 08:08:13 2024 +0000, Zhiyi Zhang wrote:
> > Hmm, i think the clearer version does have a use-after-free problem.
>
> If the item is freed in `queue_cancel_item` while
> `scheduled_item_cancelable_callback`/`waiting_item_cancelable_callback`
> is running, the latter will use-after-free.
> How can this use-after-free happen? If
> scheduled_item_cancelable_callback() is still running,
> queue_cancel_item() merely decreases the work item reference count and
> not actually releasing the object.

the use-after-free happens _if_ I add the `IUnknown_Release(&item->IUnknown_iface)`