]> www.infradead.org Git - users/jedix/linux-maple.git/commit
phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
authorYang Yingliang <yangyingliang@huawei.com>
Wed, 7 Apr 2021 09:27:16 +0000 (17:27 +0800)
committerVinod Koul <vkoul@kernel.org>
Mon, 12 Apr 2021 05:04:48 +0000 (10:34 +0530)
commitb6622bd0b906ad23c2f3eebc490dd1aa0e33ff45
tree14f162407a07602f9a9da48688361ed5ed57e7c9
parentcbc336c09b6d6dfb24d20c955599123308fa2fe2
phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()

This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210407092716.3270248-1-yangyingliang@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
drivers/phy/ti/phy-twl4030-usb.c