Messages in this thread | | | Date | Thu, 8 Apr 2021 14:38:49 +0200 | From | Sebastian Reichel <> | Subject | Re: [PATCH -next] power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() |
| |
Hi,
On Wed, Apr 07, 2021 at 05:17:06PM +0800, Yang Yingliang wrote: > This driver's remove path calls cancel_delayed_work(). However, that > function does not wait until the work function finishes. This means > that the callback function may still be running after the driver's > remove function has finished, which would result in a use-after-free. > > Fix by calling cancel_delayed_work_sync(), which ensures that > the work is properly cancelled, no longer running, and unable > to re-schedule itself. > > Reported-by: Hulk Robot <hulkci@huawei.com> > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> > ---
Thanks, queued.
-- Sebastian
> drivers/power/supply/generic-adc-battery.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c > index 0032069fbc2b..66039c665dd1 100644 > --- a/drivers/power/supply/generic-adc-battery.c > +++ b/drivers/power/supply/generic-adc-battery.c > @@ -373,7 +373,7 @@ static int gab_remove(struct platform_device *pdev) > } > > kfree(adc_bat->psy_desc.properties); > - cancel_delayed_work(&adc_bat->bat_work); > + cancel_delayed_work_sync(&adc_bat->bat_work); > return 0; > } > > -- > 2.25.1 > [unhandled content-type:application/pgp-signature] | |