diff options
| author | Zheng Wang <zyytlz.wz@163.com> | 2023-03-11 20:46:50 +0300 |
|---|---|---|
| committer | Sebastian Reichel <sebastian.reichel@collabora.com> | 2023-03-13 01:28:04 +0300 |
| commit | 06615d11cc78162dfd5116efb71f29eb29502d37 (patch) | |
| tree | a37450db9bc8c3bfa269ceed085321eb71e15fc9 /drivers/power | |
| parent | 47c29d69212911f50bdcdd0564b5999a559010d4 (diff) | |
| download | linux-06615d11cc78162dfd5116efb71f29eb29502d37.tar.xz | |
power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
In da9150_charger_probe, &charger->otg_work is bound with
da9150_charger_otg_work. da9150_charger_otg_ncb may be
called to start the work.
If we remove the module which will call da9150_charger_remove
to make cleanup, there may be a unfinished work. The possible
sequence is as follows:
Fix it by canceling the work before cleanup in the da9150_charger_remove
CPU0 CPUc1
|da9150_charger_otg_work
da9150_charger_remove |
power_supply_unregister |
device_unregister |
power_supply_dev_release|
kfree(psy) |
|
| power_supply_changed(charger->usb);
| //use
Fixes: c1a281e34dae ("power: Add support for DA9150 Charger")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Diffstat (limited to 'drivers/power')
| -rw-r--r-- | drivers/power/supply/da9150-charger.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/power/supply/da9150-charger.c b/drivers/power/supply/da9150-charger.c index 14da5c595dd9..a87aeaea38e1 100644 --- a/drivers/power/supply/da9150-charger.c +++ b/drivers/power/supply/da9150-charger.c @@ -657,6 +657,7 @@ static int da9150_charger_remove(struct platform_device *pdev) if (!IS_ERR_OR_NULL(charger->usb_phy)) usb_unregister_notifier(charger->usb_phy, &charger->otg_nb); + cancel_work_sync(&charger->otg_work); power_supply_unregister(charger->battery); power_supply_unregister(charger->usb); |