From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A39A9C433FE for ; Wed, 13 Oct 2021 09:31:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 844E860EB4 for ; Wed, 13 Oct 2021 09:31:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237064AbhJMJdS (ORCPT ); Wed, 13 Oct 2021 05:33:18 -0400 Received: from szxga01-in.huawei.com ([45.249.212.187]:28931 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235642AbhJMJdR (ORCPT ); Wed, 13 Oct 2021 05:33:17 -0400 Received: from dggemv711-chm.china.huawei.com (unknown [172.30.72.53]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4HTnGr5S9Dzbn7r; Wed, 13 Oct 2021 17:26:44 +0800 (CST) Received: from kwepemm600001.china.huawei.com (7.193.23.3) by dggemv711-chm.china.huawei.com (10.1.198.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.8; Wed, 13 Oct 2021 17:31:08 +0800 Received: from huawei.com (10.175.104.82) by kwepemm600001.china.huawei.com (7.193.23.3) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.8; Wed, 13 Oct 2021 17:31:07 +0800 From: Wang Hai To: , , , , , , , , CC: , , Subject: [PATCH] IB/cm: Fix possible use-after-free in ib_cm_cleanup() Date: Wed, 13 Oct 2021 17:30:16 +0800 Message-ID: <20211013093016.3869299-1-wanghai38@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 7BIT Content-Type: text/plain; charset=US-ASCII X-Originating-IP: [10.175.104.82] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemm600001.china.huawei.com (7.193.23.3) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-ide@vger.kernel.org This module's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself. Fixes: 8575329d4f85 ("IB/cm: Fix timewait crash after module unload") Reported-by: Hulk Robot Signed-off-by: Wang Hai --- drivers/infiniband/core/cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c index c903b74f46a4..ae0af63f3271 100644 --- a/drivers/infiniband/core/cm.c +++ b/drivers/infiniband/core/cm.c @@ -4508,7 +4508,7 @@ static void __exit ib_cm_cleanup(void) spin_lock_irq(&cm.lock); list_for_each_entry(timewait_info, &cm.timewait_list, list) - cancel_delayed_work(&timewait_info->work.work); + cancel_delayed_work_sync(&timewait_info->work.work); spin_unlock_irq(&cm.lock); ib_unregister_client(&cm_client); -- 2.25.1