]>
Commit | Line | Data |
---|---|---|
345c7afc SL |
1 | From ea1efc0e15d887fc1e2954a3ec9ae93c6292fe42 Mon Sep 17 00:00:00 2001 |
2 | From: Sven Van Asbroeck <thesven73@gmail.com> | |
3 | Date: Sun, 10 Mar 2019 14:58:24 -0400 | |
4 | Subject: iio: adc: xilinx: fix potential use-after-free on remove | |
5 | ||
6 | [ Upstream commit 62039b6aef63380ba7a37c113bbaeee8a55c5342 ] | |
7 | ||
8 | When cancel_delayed_work() returns, the delayed work may still | |
9 | be running. This means that the core could potentially free | |
10 | the private structure (struct xadc) while the delayed work | |
11 | is still using it. This is a potential use-after-free. | |
12 | ||
13 | Fix by calling cancel_delayed_work_sync(), which waits for | |
14 | any residual work to finish before returning. | |
15 | ||
16 | Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com> | |
17 | Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> | |
18 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
19 | --- | |
20 | drivers/iio/adc/xilinx-xadc-core.c | 2 +- | |
21 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
22 | ||
23 | diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c | |
24 | index 475c5a74f2d1f..6398e86a272b8 100644 | |
25 | --- a/drivers/iio/adc/xilinx-xadc-core.c | |
26 | +++ b/drivers/iio/adc/xilinx-xadc-core.c | |
27 | @@ -1299,7 +1299,7 @@ static int xadc_remove(struct platform_device *pdev) | |
28 | } | |
29 | free_irq(irq, indio_dev); | |
30 | clk_disable_unprepare(xadc->clk); | |
31 | - cancel_delayed_work(&xadc->zynq_unmask_work); | |
32 | + cancel_delayed_work_sync(&xadc->zynq_unmask_work); | |
33 | kfree(xadc->data); | |
34 | kfree(indio_dev->channels); | |
35 | ||
36 | -- | |
37 | 2.20.1 | |
38 |