Files
kernel_google_wahoo/drivers/rtc
Sven Van Asbroeck e4163587c4 rtc: 88pm860x: prevent use-after-free on device remove
[ Upstream commit f22b1ba15ee5785aa028384ebf77dd39e8e47b70 ]

The device's remove() attempts to shut down the delayed_work scheduled
on the kernel-global workqueue by calling flush_scheduled_work().

Unfortunately, flush_scheduled_work() does not prevent the delayed_work
from re-scheduling itself. The delayed_work might run after the device
has been removed, and touch the already de-allocated info structure.
This is a potential use-after-free.

Fix by calling cancel_delayed_work_sync() during remove(): this ensures
that the delayed work is properly cancelled, is no longer running, and
is not able to re-schedule itself.

This issue was detected with the help of Coccinelle.

Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-06-11 12:23:54 +02:00
..
2015-09-05 19:37:31 +02:00
2015-09-05 19:37:18 +02:00
2015-06-25 01:13:44 +02:00
2015-09-05 13:19:06 +02:00
2015-08-05 20:03:56 +08:00
2016-05-04 14:48:52 -07:00
2015-09-05 19:37:19 +02:00