From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS, T_DKIMWL_WL_HIGH,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7BBDDC04AAD for ; Tue, 7 May 2019 05:32:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 42D9C20C01 for ; Tue, 7 May 2019 05:32:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557207163; bh=b6nEX9JyoFG3leregqh5qsp2VIYU9nfUcat7IvLJ+Ic=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=iD3RSGiM6zkpGn1ObgrybkQOZ3uFL/MbmAedyTv2k/zMZXqgqydIfzFKl57bCOKei Rc7mXBg9se+DZawTZ44dvqANjgR4d/lYHcJXjV4/FrD3SEDBMJf+e5nWyC/35hyWf3 IYbURxCvs7dh1ZND17w8IuQjpysofjKMxhgRMWJs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726495AbfEGFcm (ORCPT ); Tue, 7 May 2019 01:32:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:52790 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725843AbfEGFck (ORCPT ); Tue, 7 May 2019 01:32:40 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EF8AD2087F; Tue, 7 May 2019 05:32:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557207159; bh=b6nEX9JyoFG3leregqh5qsp2VIYU9nfUcat7IvLJ+Ic=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q/CihpTQ+rFW2/LEUlx5KAcRP7Gquj3fwAOxqmFCyxijsAMB7TSOzPcDVr7i2KzXR N+tu/zvpZwgEB8urvFtu6GuD610FJAgNcIIMLjid1/b5xO+b+qDrIOc/wxyot77z74 jc8VMqhCKcwG9fRl7HGKIBvLROK34/lJlX5TGxPE= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sven Van Asbroeck , Sven Van Asbroeck , Jonathan Cameron , Sasha Levin , linux-iio@vger.kernel.org Subject: [PATCH AUTOSEL 5.0 02/99] iio: adc: xilinx: fix potential use-after-free on probe Date: Tue, 7 May 2019 01:30:56 -0400 Message-Id: <20190507053235.29900-2-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190507053235.29900-1-sashal@kernel.org> References: <20190507053235.29900-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sven Van Asbroeck [ Upstream commit 862e4644fd2d7df8998edc65e0963ea2f567bde9 ] If probe errors out after request_irq(), its error path does not explicitly cancel the delayed work, which may have been scheduled by the interrupt handler. This means the delayed work may still be running when the core frees the private structure (struct xadc). This is a potential use-after-free. Fix by inserting cancel_delayed_work_sync() in the probe error path. Signed-off-by: Sven Van Asbroeck Signed-off-by: Jonathan Cameron Signed-off-by: Sasha Levin --- drivers/iio/adc/xilinx-xadc-core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 1960694e8007..15e1a103f37d 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1290,6 +1290,7 @@ static int xadc_probe(struct platform_device *pdev) err_free_irq: free_irq(xadc->irq, indio_dev); + cancel_delayed_work_sync(&xadc->zynq_unmask_work); err_clk_disable_unprepare: clk_disable_unprepare(xadc->clk); err_free_samplerate_trigger: -- 2.20.1