From patchwork Sun Mar 10 18:58:25 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Van Asbroeck X-Patchwork-Id: 10846433 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 94565922 for ; Sun, 10 Mar 2019 18:59:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7CDDE28554 for ; Sun, 10 Mar 2019 18:59:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6DFAF28574; Sun, 10 Mar 2019 18:59:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,DKIM_VALID,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 1B0FE28554 for ; Sun, 10 Mar 2019 18:59:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=IeYAX9HXfiFOxAyg9c+oNX4cGHjwBrdbOvQMbJE4O7g=; b=tidkVuPYehk4ly/MClezUA0s5l UPb72/Xh+t48o6VSkwIzfj7OKM87FH+TRzeQTpdv7CRNISeisUzHVIhxgul0tSFUXLlxHhpN+2p1a G2ZSCGQZqhwjjSJAUKaDl0QEI6SB24B8+q4I1Y9IdS+6xw8aazkgDxBA51FWm0aCiJIb+lOK9ii7M u+kUXsYiPfPdONaFm8+iSfP7vDJ6WpKiT9RNk5Lfd9HAHTMN/l/508C8kg2P+wtaQicQWd8ER7z3E wK2VkLu0yv4jMSPydOunj6gOZPXMSx2sXYsKcjByrUEGdsn4Litx1uMYKfhiAzFhqdytoAKk60Hf4 sH+DeXuQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1h33f3-0000JO-21; Sun, 10 Mar 2019 18:59:01 +0000 Received: from mail-it1-x141.google.com ([2607:f8b0:4864:20::141]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1h33ef-0008Ha-Km for linux-arm-kernel@lists.infradead.org; Sun, 10 Mar 2019 18:58:40 +0000 Received: by mail-it1-x141.google.com with SMTP id g17so3894465ita.2 for ; Sun, 10 Mar 2019 11:58:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=fxgFiCRKgpoCxt3b7qAJzupwn0XavxwiX5uUbpM/OII=; b=a9fshGZZ7i/tLOZepomjCBDfixyvFGzizvaDmgosBgbXN7+q1UJ/ZsN5OMR7TXZO3s OZsLl6fn5MRTxgtWXvRFdonnegXiOaRpFUqi+BHCHk4QjwpF+oxN+I5uNuEo4aOxZ7bZ r3fpKQHgmXCmSfjPDLwXnbs4/ueXM4Q9UrvmuK57Ao1e8UzEoS6wTrrZRp7cJJfs+zJq KtTwS33zSuk6UDDDspaMdOJHuUwGaDrS1JU04+N5oLT71uISpVnTdm0I4ZRxnBW7Qa4q bc2JXN+ybhDqk23+9lFgSLQBqaT+oyXxRhLcNPTVLQlQWMtEy1zu1v6pAlY60w5GoBuV a6xQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=fxgFiCRKgpoCxt3b7qAJzupwn0XavxwiX5uUbpM/OII=; b=rGQwoMWE63oof1RMbTNbAp6boVDVw+YPxnhjuVSuvEZfhd9bFHMBsqf50FEpG35TKP x3ebHwrXUaQLFoc+o0o5P6XHNCPO3IeDRnbuOq7O9VGVpTWIL8gSCdObrxWqdEEC7NBX fcwmC7OnRkY+0CzfQsskyotZqZQRqys/1AdamWfLTnUjs5YJJ96fe/JDN2B41tYXIWiq yWapDBD0MH4Z7k6BKSL7uFylA+ydm7mCkiQ59W+L94nqQaufeeRLM2ho9r45RPHZTpc0 /IlJr1o6aiema78za1hSJxKyov1phlpAkK9iB2cVoT+0Cpj/NAuYE7VI2KIz/ywDWcw7 Q/Aw== X-Gm-Message-State: APjAAAW6s3JBqDBVmAzaj8/LMcHuY6QiV3epzcRtBN/xZ5u3GUW/9eRo NKy5xduaLnzVdgRjDZs9b1Y= X-Google-Smtp-Source: APXvYqyGASuFsKMDYrVtGpg9O7HRaj1RL78fLP+QSyIZRt5Ha5mt6iBOlsy3QMRJjIlQs682yv+8YA== X-Received: by 2002:a24:1cc6:: with SMTP id c189mr12881577itc.74.1552244315449; Sun, 10 Mar 2019 11:58:35 -0700 (PDT) Received: from localhost.localdomain ([198.52.185.227]) by smtp.gmail.com with ESMTPSA id y18sm1359270ioa.56.2019.03.10.11.58.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 10 Mar 2019 11:58:35 -0700 (PDT) From: Sven Van Asbroeck X-Google-Original-From: Sven Van Asbroeck To: Jonathan Cameron Subject: [PATCH 2/3] iio: adc: xilinx: fix potential use-after-free on probe Date: Sun, 10 Mar 2019 14:58:25 -0400 Message-Id: <20190310185826.25916-2-TheSven73@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190310185826.25916-1-TheSven73@gmail.com> References: <20190310185826.25916-1-TheSven73@gmail.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190310_115837_676876_7C066B83 X-CRM114-Status: GOOD ( 11.94 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lars-Peter Clausen , linux-iio@vger.kernel.org, Michal Simek , linux-kernel@vger.kernel.org, Manish Narani , Peter Meerwald-Stadler , Hartmut Knaack , linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP If probe errors out after request_irq(), its error path does not explicitly cancel the delayed work, which may have been scheduled by the interrupt handler. This means the delayed work may still be running when the core frees the private structure (struct xadc). This is a potential use-after-free. Fix by inserting cancel_delayed_work_sync() in the probe error path. Signed-off-by: Sven Van Asbroeck --- drivers/iio/adc/xilinx-xadc-core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 1960694e8007..15e1a103f37d 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1290,6 +1290,7 @@ static int xadc_probe(struct platform_device *pdev) err_free_irq: free_irq(xadc->irq, indio_dev); + cancel_delayed_work_sync(&xadc->zynq_unmask_work); err_clk_disable_unprepare: clk_disable_unprepare(xadc->clk); err_free_samplerate_trigger: