Commit 62039b6a authored Mar 10, 2019 by Sven Van Asbroeck Committed by Jonathan Cameron Mar 16, 2019

iio: adc: xilinx: fix potential use-after-free on remove



When cancel_delayed_work() returns, the delayed work may still
be running. This means that the core could potentially free
the private structure (struct xadc) while the delayed work
is still using it. This is a potential use-after-free.

Fix by calling cancel_delayed_work_sync(), which waits for
any residual work to finish before returning.

Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

parent 06003531

drivers/iio/adc/xilinx-xadc-core.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1322,7 +1322,7 @@ static int xadc_remove(struct platform_device *pdev)
		}
		free_irq(xadc->irq, indio_dev);
		clk_disable_unprepare(xadc->clk);
		cancel_delayed_work(&xadc->zynq_unmask_work);
		cancel_delayed_work_sync(&xadc->zynq_unmask_work);
		kfree(xadc->data);
		kfree(indio_dev->channels);

Admin message