lkml.org 
[lkml]   [2023]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v2] misc: ti-st: st_kim: Fix use after free bug in kim_remove due to race condition
Date
In kim_probe, it called st_core_init and bound &st_gdata->work_write_wakeup
with work_fn_write_wakeup.
When it calls st_tty_wakeup, it will finally call schedule_work to start
the work.

When we call kim_remove to remove the driver, there
may be a sequence as follows:

Fix it by finishing the work before cleanup in kim_remove

CPU0 CPU1

|work_fn_write_wakeup
kim_remove |
st_core_exit |
kfree(st_gdata)|
|st_tx_wakeup
|//use st_gdata

Fixes: b05b7c7cc032 ("ti-st: use worker instead of calling st_int_write in wake up")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
v2:
- fix error from kernek_test-robot
---
drivers/misc/ti-st/st_kim.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index f2f6cab97c08..497ba8d8df27 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -785,8 +785,12 @@ static int kim_remove(struct platform_device *pdev)
/* free the GPIOs requested */
struct ti_st_plat_data *pdata = pdev->dev.platform_data;
struct kim_data_s *kim_gdata;
+ struct st_data_s *st_gdata;

kim_gdata = platform_get_drvdata(pdev);
+ st_gdata = kim_gdata->core_data;
+
+ cancel_work_sync(&st_gdata->work_write_wakeup);

/*
* Free the Bluetooth/FM/GPIO
@@ -800,7 +804,7 @@ static int kim_remove(struct platform_device *pdev)
pr_info("sysfs entries removed");

kim_gdata->kim_pdev = NULL;
- st_core_exit(kim_gdata->core_data);
+ st_core_exit(st_gdata);

kfree(kim_gdata);
kim_gdata = NULL;
--
2.25.1
\
 
 \ /
  Last update: 2023-03-27 01:07    [W:0.024 / U:0.912 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site