Messages in this thread Patch in this message | | | From | Zheng Wang <> | Subject | [PATCH] hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition | Date | Fri, 10 Mar 2023 16:40:07 +0800 |
| |
In xgene_hwmon_probe, &ctx->workq is bound with xgene_hwmon_evt_work. Then it will be started.
If we remove the driver which will call xgene_hwmon_remove to make cleanup, there may be a unfinished work.
The possiblesequence is as follows:
Fix it by finishing the work before cleanup in the xgene_hwmon_remove
CPU0 CPU1
|xgene_hwmon_evt_work xgene_hwmon_remove | kfifo_free(&ctx->async_msg_fifo);| | |kfifo_out_spinlocked |//use &ctx->async_msg_fifo Fixes: 2ca492e22cb7 ("hwmon: (xgene) Fix crash when alarm occurs before driver probe") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> --- drivers/hwmon/xgene-hwmon.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c index 5cde837bfd09..d1abea49f01b 100644 --- a/drivers/hwmon/xgene-hwmon.c +++ b/drivers/hwmon/xgene-hwmon.c @@ -761,6 +761,7 @@ static int xgene_hwmon_remove(struct platform_device *pdev) { struct xgene_hwmon_dev *ctx = platform_get_drvdata(pdev); + cancel_work_sync(&ctx->workq); hwmon_device_unregister(ctx->hwmon_dev); kfifo_free(&ctx->async_msg_fifo); if (acpi_disabled) -- 2.25.1
| |