Files
linux/drivers/rtc
Sven Van Asbroeck 8685a29897 rtc: 88pm860x: prevent use-after-free on device remove
[ Upstream commit f22b1ba15e ]

The device's remove() attempts to shut down the delayed_work scheduled
on the kernel-global workqueue by calling flush_scheduled_work().

Unfortunately, flush_scheduled_work() does not prevent the delayed_work
from re-scheduling itself. The delayed_work might run after the device
has been removed, and touch the already de-allocated info structure.
This is a potential use-after-free.

Fix by calling cancel_delayed_work_sync() during remove(): this ensures
that the delayed work is properly cancelled, is no longer running, and
is not able to re-schedule itself.

This issue was detected with the help of Coccinelle.

Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-05-31 06:48:15 -07:00
..
2016-08-31 18:21:34 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2015-09-05 13:19:06 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00
2013-04-19 13:51:25 +02:00
2016-05-20 12:33:51 +02:00
2016-05-20 12:33:51 +02:00