lkml.org 
[lkml]   [2022]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] mISDN: hfcpci: Fix use-after-free bug in hfcpci_Timer
Date
If the timer handler hfcpci_Timer() is running, the
del_timer(&hc->hw.timer) in release_io_hfcpci() could
not stop it. As a result, the use-after-free bug will
happen. The process is shown below:

(cleanup routine) | (timer handler)
release_card() | hfcpci_Timer()
release_io_hfcpci |
del_timer(&hc->hw.timer) |
... | ...
kfree(hc) //[1]FREE |
| hc->hw.timer.expires //[2]USE

The hfc_pci is deallocated in position [1] and used in
position [2].

Fix by changing del_timer() in release_io_hfcpci() to
del_timer_sync(), which makes sure the hfcpci_Timer()
have finished before the hfc_pci is deallocated.

Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
---
drivers/isdn/hardware/mISDN/hfcpci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index af17459c1a5..5cf37fe7de2 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -157,7 +157,7 @@ release_io_hfcpci(struct hfc_pci *hc)
{
/* disable memory mapped ports + busmaster */
pci_write_config_word(hc->pdev, PCI_COMMAND, 0);
- del_timer(&hc->hw.timer);
+ del_timer_sync(&hc->hw.timer);
dma_free_coherent(&hc->pdev->dev, 0x8000, hc->hw.fifos,
hc->hw.dmahandle);
iounmap(hc->hw.pci_io);
--
2.17.1
\
 
 \ /
  Last update: 2022-10-13 14:59    [W:0.090 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site