Messages in this thread | | | Date | Wed, 9 Jun 2021 18:59:16 +0200 | From | Greg KH <> | Subject | Re: [PATCH 2/3] bus: mhi: pci_generic: Fix possible use-after-free in mhi_pci_remove() |
| |
On Sun, Jun 06, 2021 at 09:07:40PM +0530, Manivannan Sadhasivam wrote: > From: Wei Yongjun <weiyongjun1@huawei.com> > > This driver's remove path calls del_timer(). However, that function > does not wait until the timer handler finishes. This means that the > timer handler may still be running after the driver's remove function > has finished, which would result in a use-after-free. > > Fix by calling del_timer_sync(), which makes sure the timer handler > has finished, and unable to re-schedule itself. > > Fixes: 8562d4fe34a3 ("mhi: pci_generic: Add health-check") > Reported-by: Hulk Robot <hulkci@huawei.com> > Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> > Reviewed-by: Hemant kumar <hemantk@codeaurora.org> > Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> > Reviewed-by: Loic Poulain <loic.poulain@linaro.org> > Link: https://lore.kernel.org/r/20210413160318.2003699-1-weiyongjun1@huawei.com > Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> > --- > drivers/bus/mhi/pci_generic.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-)
No Cc: stable on this? I'll go add it...
| |