Messages in this thread Patch in this message | | | From | Zheng Wang <> | Subject | [PATCH v2] misc: ti-st: st_kim: Fix use after free bug in kim_remove due to race condition | Date | Mon, 20 Mar 2023 14:24:35 +0800 |
| |
In kim_probe, it called st_core_init and bound &st_gdata->work_write_wakeup with work_fn_write_wakeup. When it calls st_tty_wakeup, it will finally call schedule_work to start the work.
When we call kim_remove to remove the driver, there may be a sequence as follows:
Fix it by finishing the work before cleanup in kim_remove
CPU0 CPU1
|work_fn_write_wakeup kim_remove | st_core_exit | kfree(st_gdata)| |st_tx_wakeup |//use st_gdata
Fixes: b05b7c7cc032 ("ti-st: use worker instead of calling st_int_write in wake up") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> --- v2: - fix error from kernek_test-robot --- drivers/misc/ti-st/st_kim.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c index f2f6cab97c08..497ba8d8df27 100644 --- a/drivers/misc/ti-st/st_kim.c +++ b/drivers/misc/ti-st/st_kim.c @@ -785,8 +785,12 @@ static int kim_remove(struct platform_device *pdev) /* free the GPIOs requested */ struct ti_st_plat_data *pdata = pdev->dev.platform_data; struct kim_data_s *kim_gdata; + struct st_data_s *st_gdata; kim_gdata = platform_get_drvdata(pdev); + st_gdata = kim_gdata->core_data; + + cancel_work_sync(&st_gdata->work_write_wakeup); /* * Free the Bluetooth/FM/GPIO @@ -800,7 +804,7 @@ static int kim_remove(struct platform_device *pdev) pr_info("sysfs entries removed"); kim_gdata->kim_pdev = NULL; - st_core_exit(kim_gdata->core_data); + st_core_exit(st_gdata); kfree(kim_gdata); kim_gdata = NULL; -- 2.25.1
| |