Searched hist:63264422 (Results 1 – 1 of 1) sorted by relevance
/openbmc/linux/drivers/memstick/host/ |
H A D | r592.c | 63264422 Tue Mar 07 10:43:38 CST 2023 Zheng Wang <zyytlz.wz@163.com> memstick: r592: Fix UAF bug in r592_remove due to race condition
In r592_probe, dev->detect_timer was bound with r592_detect_timer. In r592_irq function, the timer function will be invoked by mod_timer.
If we remove the module which will call hantro_release to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug.
Fix it by canceling the work before cleanup in r592_remove.
CPU0 CPU1
|r592_detect_timer r592_remove | memstick_free_host| put_device; | kfree(host); | | | queue_work | &host->media_checker //use
Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Link: https://lore.kernel.org/r/20230307164338.1246287-1-zyytlz.wz@163.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
|