Messages in this thread | | | From | Zheng Hacker <> | Date | Tue, 14 Mar 2023 00:56:31 +0800 | Subject | Re: [PATCH] nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition |
| |
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> 于2023年3月13日周一 14:52写道: > > On 12/03/2023 17:08, Zheng Wang wrote: > > This bug influences both st_nci_i2c_remove and st_nci_spi_remove. > > Take st_nci_i2c_remove as an example. > > > > In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work > > with llt_ndlc_sm_work. > > > > When it calls ndlc_recv or timeout handler, it will finally call > > schedule_work to start the work. > > > > When we call st_nci_i2c_remove to remove the driver, there > > may be a sequence as follows: > > > > Fix it by finishing the work before cleanup in ndlc_remove > > > Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> >
Thanks for the detailed review.
Best regards, Zheng
> Best regards, > Krzysztof >
| |