diff options
| author | Sven Van Asbroeck <thesven73@gmail.com> | 2019-03-10 21:58:24 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-05-16 20:41:18 +0300 |
| commit | 06d5ea398e554a3a6fe2616de44b8a8cb99f946d (patch) | |
| tree | ceaa78a6eab01defaef6fcca0975f66ea69a7af4 | |
| parent | 5640d0781267c1c883dbdbc1cd6008a1514b029d (diff) | |
| download | linux-06d5ea398e554a3a6fe2616de44b8a8cb99f946d.tar.xz | |
iio: adc: xilinx: fix potential use-after-free on remove
[ Upstream commit 62039b6aef63380ba7a37c113bbaeee8a55c5342 ]
When cancel_delayed_work() returns, the delayed work may still
be running. This means that the core could potentially free
the private structure (struct xadc) while the delayed work
is still using it. This is a potential use-after-free.
Fix by calling cancel_delayed_work_sync(), which waits for
any residual work to finish before returning.
Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/iio/adc/xilinx-xadc-core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 3f6be5ac049a..1960694e8007 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1320,7 +1320,7 @@ static int xadc_remove(struct platform_device *pdev) } free_irq(xadc->irq, indio_dev); clk_disable_unprepare(xadc->clk); - cancel_delayed_work(&xadc->zynq_unmask_work); + cancel_delayed_work_sync(&xadc->zynq_unmask_work); kfree(xadc->data); kfree(indio_dev->channels); |