| Message ID | 20190310185826.25916-3-TheSven73@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/3] iio: adc: xilinx: fix potential use-after-free on remove | expand |
On Sun, 10 Mar 2019 14:58:26 -0400 Sven Van Asbroeck <thesven73@gmail.com> wrote: > In remove, the clock is disabled before canceling the > delayed work. This means that the delayed work may be > touching unclocked hardware. > > Fix by disabling the clock after the delayed work is > fully canceled. This is consistent with the probe error > path order. > > Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com> Applied to the fixes-togreg branch of iio.git. Thanks, Jonathan > --- > drivers/iio/adc/xilinx-xadc-core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c > index 15e1a103f37d..1ae86e7359f7 100644 > --- a/drivers/iio/adc/xilinx-xadc-core.c > +++ b/drivers/iio/adc/xilinx-xadc-core.c > @@ -1320,8 +1320,8 @@ static int xadc_remove(struct platform_device *pdev) > iio_triggered_buffer_cleanup(indio_dev); > } > free_irq(xadc->irq, indio_dev); > - clk_disable_unprepare(xadc->clk); > cancel_delayed_work_sync(&xadc->zynq_unmask_work); > + clk_disable_unprepare(xadc->clk); > kfree(xadc->data); > kfree(indio_dev->channels); >
On Sat, Mar 16, 2019 at 11:51 AM Jonathan Cameron <jic23@kernel.org> wrote: > > Applied to the fixes-togreg branch of iio.git. > Thank you kindly for taking this patch set, Jonathan.
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 15e1a103f37d..1ae86e7359f7 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1320,8 +1320,8 @@ static int xadc_remove(struct platform_device *pdev) iio_triggered_buffer_cleanup(indio_dev); } free_irq(xadc->irq, indio_dev); - clk_disable_unprepare(xadc->clk); cancel_delayed_work_sync(&xadc->zynq_unmask_work); + clk_disable_unprepare(xadc->clk); kfree(xadc->data); kfree(indio_dev->channels);
In remove, the clock is disabled before canceling the delayed work. This means that the delayed work may be touching unclocked hardware. Fix by disabling the clock after the delayed work is fully canceled. This is consistent with the probe error path order. Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com> --- drivers/iio/adc/xilinx-xadc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)