Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 06d5ea39 authored by Sven Van Asbroeck's avatar Sven Van Asbroeck Committed by Greg Kroah-Hartman
Browse files

iio: adc: xilinx: fix potential use-after-free on remove 



[ Upstream commit 62039b6aef63380ba7a37c113bbaeee8a55c5342 ]

When cancel_delayed_work() returns, the delayed work may still
be running. This means that the core could potentially free
the private structure (struct xadc) while the delayed work
is still using it. This is a potential use-after-free.

Fix by calling cancel_delayed_work_sync(), which waits for
any residual work to finish before returning.

Signed-off-by: default avatarSven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 5640d078

drivers/iio/adc/xilinx-xadc-core.c

+1 −1
Original line number Diff line number Diff line
@@ -1320,7 +1320,7 @@ static int xadc_remove(struct platform_device *pdev) 
	}

	free_irq(xadc->irq, indio_dev);

	clk_disable_unprepare(xadc->clk);

	cancel_delayed_work(&xadc->zynq_unmask_work);

	cancel_delayed_work_sync(&xadc->zynq_unmask_work);

	kfree(xadc->data);

	kfree(indio_dev->channels);