Messages in this thread | | | Date | Sat, 16 Mar 2019 15:49:21 +0000 | From | Jonathan Cameron <> | Subject | Re: [PATCH 2/3] iio: adc: xilinx: fix potential use-after-free on probe |
| |
On Sun, 10 Mar 2019 14:58:25 -0400 Sven Van Asbroeck <thesven73@gmail.com> wrote:
> If probe errors out after request_irq(), its error path > does not explicitly cancel the delayed work, which may > have been scheduled by the interrupt handler. > > This means the delayed work may still be running when > the core frees the private structure (struct xadc). > This is a potential use-after-free. > > Fix by inserting cancel_delayed_work_sync() in the probe > error path. > > Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com> Again, seems fine to me.
Applied to the fixes-togreg branch of iio.git.
thanks,
Jonathan
> --- > drivers/iio/adc/xilinx-xadc-core.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c > index 1960694e8007..15e1a103f37d 100644 > --- a/drivers/iio/adc/xilinx-xadc-core.c > +++ b/drivers/iio/adc/xilinx-xadc-core.c > @@ -1290,6 +1290,7 @@ static int xadc_probe(struct platform_device *pdev) > > err_free_irq: > free_irq(xadc->irq, indio_dev); > + cancel_delayed_work_sync(&xadc->zynq_unmask_work); > err_clk_disable_unprepare: > clk_disable_unprepare(xadc->clk); > err_free_samplerate_trigger:
| |