Files
linux/drivers/rtc
Sven Van Asbroeck 29fb31a569 rtc: 88pm860x: prevent use-after-free on device remove
[ Upstream commit f22b1ba15e ]

The device's remove() attempts to shut down the delayed_work scheduled
on the kernel-global workqueue by calling flush_scheduled_work().

Unfortunately, flush_scheduled_work() does not prevent the delayed_work
from re-scheduling itself. The delayed_work might run after the device
has been removed, and touch the already de-allocated info structure.
This is a potential use-after-free.

Fix by calling cancel_delayed_work_sync() during remove(): this ensures
that the delayed work is properly cancelled, is no longer running, and
is not able to re-schedule itself.

This issue was detected with the help of Coccinelle.

Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-15 13:00:05 +09:00
..
2016-08-31 18:21:34 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2015-09-05 13:19:06 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2013-04-19 13:51:25 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00