lkml.org 
[lkml]   [2019]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 4.4 v1] power: supply: ltc2941-battery-gauge: fix use-after-free
On Thu, Sep 19, 2019 at 03:02:08PM -0400, Sven Van Asbroeck wrote:
> This driver's remove path calls cancel_delayed_work().
> However, that function does not wait until the work function
> finishes. This could mean that the work function is still
> running after the driver's remove function has finished,
> which would result in a use-after-free.
>
> Fix by calling cancel_delayed_work_sync(), which ensures that
> that the work is properly cancelled, no longer running, and
> unable to re-schedule itself.
>
> This issue was detected with the help of Coccinelle.
>
> Cc: stable <stable@vger.kernel.org>
> Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
> ---
> drivers/power/ltc2941-battery-gauge.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/power/ltc2941-battery-gauge.c b/drivers/power/ltc2941-battery-gauge.c
> index da49436176cd..30a9014b2f95 100644
> --- a/drivers/power/ltc2941-battery-gauge.c
> +++ b/drivers/power/ltc2941-battery-gauge.c
> @@ -449,7 +449,7 @@ static int ltc294x_i2c_remove(struct i2c_client *client)
> {
> struct ltc294x_info *info = i2c_get_clientdata(client);
>
> - cancel_delayed_work(&info->work);
> + cancel_delayed_work_sync(&info->work);
> power_supply_unregister(info->supply);
> return 0;
> }
> --
> 2.17.1
>

What is the git commit id of this patch in Linus's tree?

thanks,

greg k-h

\
 
 \ /
  Last update: 2019-12-02 19:44    [W:0.055 / U:0.520 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site