iio: adc: xilinx: fix potential use-after-free on remove

This change “iio: adc: xilinx: fix potential use-after-free on remove” (commit 62039b6) in Linux kernel is authored by Sven Van Asbroeck <thesven73 [at] gmail.com> on Sun Mar 10 14:58:24 2019 -0400.

Description of "iio: adc: xilinx: fix potential use-after-free on remove"

The change “iio: adc: xilinx: fix potential use-after-free on remove” introduces changes as follows.

iio: adc: xilinx: fix potential use-after-free on remove

When cancel_delayed_work() returns, the delayed work may still
be running. This means that the core could potentially free
the private structure (struct xadc) while the delayed work
is still using it. This is a potential use-after-free.

Fix by calling cancel_delayed_work_sync(), which waits for
any residual work to finish before returning.

Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

Linux kernel releases containing commit 62039b6

Linux kernel code changes from "iio: adc: xilinx: fix potential use-after-free on remove"

There are 2 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/iio/adc/xilinx-xadc-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index b13c61539d46..ef3afaeed194 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -1322,7 +1322,7 @@ static int xadc_remove(struct platform_device *pdev)
 	}
 	free_irq(xadc->irq, indio_dev);
 	clk_disable_unprepare(xadc->clk);
-	cancel_delayed_work(&xadc->zynq_unmask_work);
+	cancel_delayed_work_sync(&xadc->zynq_unmask_work);
 	kfree(xadc->data);
 	kfree(indio_dev->channels);
 

The commit for this change in Linux stable tree is 62039b6 (patch).

Last modified: 2020/02/09