lkml.org 
[lkml]   [2021]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 2/3] bus: mhi: pci_generic: Fix possible use-after-free in mhi_pci_remove()
On Sun, Jun 06, 2021 at 09:07:40PM +0530, Manivannan Sadhasivam wrote:
> From: Wei Yongjun <weiyongjun1@huawei.com>
>
> This driver's remove path calls del_timer(). However, that function
> does not wait until the timer handler finishes. This means that the
> timer handler may still be running after the driver's remove function
> has finished, which would result in a use-after-free.
>
> Fix by calling del_timer_sync(), which makes sure the timer handler
> has finished, and unable to re-schedule itself.
>
> Fixes: 8562d4fe34a3 ("mhi: pci_generic: Add health-check")
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
> Reviewed-by: Hemant kumar <hemantk@codeaurora.org>
> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
> Link: https://lore.kernel.org/r/20210413160318.2003699-1-weiyongjun1@huawei.com
> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> ---
> drivers/bus/mhi/pci_generic.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)

No Cc: stable on this? I'll go add it...

\
 
 \ /
  Last update: 2021-06-09 18:59    [W:0.081 / U:0.800 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site