Messages in this thread Patch in this message | | | From | Duoming Zhou <> | Subject | [PATCH] mISDN: hfcpci: Fix use-after-free bug in hfcpci_Timer | Date | Thu, 13 Oct 2022 20:57:29 +0800 |
| |
If the timer handler hfcpci_Timer() is running, the del_timer(&hc->hw.timer) in release_io_hfcpci() could not stop it. As a result, the use-after-free bug will happen. The process is shown below:
(cleanup routine) | (timer handler) release_card() | hfcpci_Timer() release_io_hfcpci | del_timer(&hc->hw.timer) | ... | ... kfree(hc) //[1]FREE | | hc->hw.timer.expires //[2]USE
The hfc_pci is deallocated in position [1] and used in position [2].
Fix by changing del_timer() in release_io_hfcpci() to del_timer_sync(), which makes sure the hfcpci_Timer() have finished before the hfc_pci is deallocated.
Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- drivers/isdn/hardware/mISDN/hfcpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c index af17459c1a5..5cf37fe7de2 100644 --- a/drivers/isdn/hardware/mISDN/hfcpci.c +++ b/drivers/isdn/hardware/mISDN/hfcpci.c @@ -157,7 +157,7 @@ release_io_hfcpci(struct hfc_pci *hc) { /* disable memory mapped ports + busmaster */ pci_write_config_word(hc->pdev, PCI_COMMAND, 0); - del_timer(&hc->hw.timer); + del_timer_sync(&hc->hw.timer); dma_free_coherent(&hc->pdev->dev, 0x8000, hc->hw.fifos, hc->hw.dmahandle); iounmap(hc->hw.pci_io); -- 2.17.1
| |