From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yang Yingliang <yangyingliang@huawei.com>,
Hulk Robot <hulkci@huawei.com>,
Hans Verkuil <hverkuil-cisco@xs4all.nl>,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 17/24] media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove()
Date: Mon, 3 May 2021 12:42:45 -0400 [thread overview]
Message-ID: <20210503164252.2854487-17-sashal@kernel.org> (raw)
In-Reply-To: <20210503164252.2854487-1-sashal@kernel.org>
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 2c9541720c66899adf6f3600984cf3ef151295ad ]
This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.
Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/adv7511-v4l2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
index b87c9e7ff146..e81c4cca50c6 100644
--- a/drivers/media/i2c/adv7511-v4l2.c
+++ b/drivers/media/i2c/adv7511-v4l2.c
@@ -1976,7 +1976,7 @@ static int adv7511_remove(struct i2c_client *client)
adv7511_set_isr(sd, false);
adv7511_init_setup(sd);
- cancel_delayed_work(&state->edid_handler);
+ cancel_delayed_work_sync(&state->edid_handler);
i2c_unregister_device(state->i2c_edid);
if (state->i2c_cec)
i2c_unregister_device(state->i2c_cec);
--
2.30.2
next prev parent reply other threads:[~2021-05-03 16:57 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20210503164252.2854487-1-sashal@kernel.org>
2021-05-03 16:42 ` [PATCH AUTOSEL 4.9 02/24] media: ite-cir: check for receive overflow Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.9 04/24] media: media/saa7164: fix saa7164_encoder_register() memory leak bugs Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.9 05/24] media: gspca/sq905.c: fix uninitialized variable Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.9 06/24] media: pci: saa7164: Rudimentary spelling fixes in the file saa7164-types.h Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.9 12/24] media: em28xx: fix memory leak Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.9 16/24] media: adv7604: fix possible use-after-free in adv76xx_remove() Sasha Levin
2021-05-03 16:42 ` Sasha Levin [this message]
2021-05-03 16:42 ` [PATCH AUTOSEL 4.9 18/24] media: i2c: adv7842: fix possible use-after-free in adv7842_remove() Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.9 19/24] media: dvb-usb: fix memory leak in dvb_usb_adapter_init Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.9 20/24] media: gscpa/stv06xx: fix memory leak Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210503164252.2854487-17-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=hulkci@huawei.com \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+huawei@kernel.org \
--cc=stable@vger.kernel.org \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).