releases/4.4.180/iio-adc-xilinx-fix-potential-use-after-free-on-remov.patch

   1 From ea1efc0e15d887fc1e2954a3ec9ae93c6292fe42 Mon Sep 17 00:00:00 2001
   2 From: Sven Van Asbroeck <thesven73@gmail.com>
   3 Date: Sun, 10 Mar 2019 14:58:24 -0400
   4 Subject: iio: adc: xilinx: fix potential use-after-free on remove
   5
   6 [ Upstream commit 62039b6aef63380ba7a37c113bbaeee8a55c5342 ]
   7
   8 When cancel_delayed_work() returns, the delayed work may still
   9 be running. This means that the core could potentially free
  10 the private structure (struct xadc) while the delayed work
  11 is still using it. This is a potential use-after-free.
  12
  13 Fix by calling cancel_delayed_work_sync(), which waits for
  14 any residual work to finish before returning.
  15
  16 Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
  17 Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
  18 Signed-off-by: Sasha Levin <sashal@kernel.org>
  19 ---
  20  drivers/iio/adc/xilinx-xadc-core.c | 2 +-
  21  1 file changed, 1 insertion(+), 1 deletion(-)
  22
  23 diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
  24 index 475c5a74f2d1f..6398e86a272b8 100644
  25 --- a/drivers/iio/adc/xilinx-xadc-core.c
  26 +++ b/drivers/iio/adc/xilinx-xadc-core.c
  27 @@ -1299,7 +1299,7 @@ static int xadc_remove(struct platform_device *pdev)
  28         }
  29         free_irq(irq, indio_dev);
  30         clk_disable_unprepare(xadc->clk);
  31 -       cancel_delayed_work(&xadc->zynq_unmask_work);
  32 +       cancel_delayed_work_sync(&xadc->zynq_unmask_work);
  33         kfree(xadc->data);
  34         kfree(indio_dev->channels);
  35
  36 --
  37 2.20.1
  38