linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yang Yingliang <yangyingliang@huawei.com>,
	Hulk Robot <hulkci@huawei.com>, Vinod Koul <vkoul@kernel.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>,
	linux-phy@lists.infradead.org
Subject: [PATCH AUTOSEL 4.19 19/21] phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
Date: Sun,  2 May 2021 10:05:15 -0400	[thread overview]
Message-ID: <20210502140517.2719912-19-sashal@kernel.org> (raw)
In-Reply-To: <20210502140517.2719912-1-sashal@kernel.org>

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit e1723d8b87b73ab363256e7ca3af3ddb75855680 ]

This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210407092716.3270248-1-yangyingliang@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/ti/phy-twl4030-usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c
index c267afb68f07..ea7564392108 100644
--- a/drivers/phy/ti/phy-twl4030-usb.c
+++ b/drivers/phy/ti/phy-twl4030-usb.c
@@ -801,7 +801,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)
 
 	usb_remove_phy(&twl->phy);
 	pm_runtime_get_sync(twl->dev);
-	cancel_delayed_work(&twl->id_workaround_work);
+	cancel_delayed_work_sync(&twl->id_workaround_work);
 	device_remove_file(twl->dev, &dev_attr_vbus);
 
 	/* set transceiver mode to power on defaults */
-- 
2.30.2


  parent reply	other threads:[~2021-05-02 14:08 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-02 14:04 [PATCH AUTOSEL 4.19 01/21] staging: wimax/i2400m: fix byte-order issue Sasha Levin
2021-05-02 14:04 ` [PATCH AUTOSEL 4.19 02/21] crypto: api - check for ERR pointers in crypto_destroy_tfm() Sasha Levin
2021-05-02 14:04 ` [PATCH AUTOSEL 4.19 03/21] usb: gadget: uvc: add bInterval checking for HS mode Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 04/21] genirq/matrix: Prevent allocation counter corruption Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 05/21] usb: gadget: f_uac1: validate input parameters Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 06/21] usb: dwc3: gadget: Ignore EP queue requests during bus reset Sasha Levin
2021-05-10 12:03   ` Pavel Machek
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 07/21] usb: xhci: Fix port minor revision Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 08/21] PCI: PM: Do not read power state in pci_enable_device_flags() Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 09/21] x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 10/21] tee: optee: do not check memref size on return from Secure World Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 11/21] perf/arm_pmu_platform: Fix error handling Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 12/21] usb: xhci-mtk: support quirk to disable usb2 lpm Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 13/21] xhci: check control context is valid before dereferencing it Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 14/21] xhci: fix potential array out of bounds with several interrupters Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 15/21] spi: dln2: Fix reference leak to master Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 16/21] spi: omap-100k: " Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 17/21] platform/x86: thinkpad_acpi: Correct thermal sensor allocation Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 18/21] intel_th: Consistency and off-by-one fix Sasha Levin
2021-05-02 14:05 ` Sasha Levin [this message]
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 20/21] crypto: omap-aes - Fix PM reference leak on omap-aes.c Sasha Levin
2021-05-02 14:05 ` [PATCH AUTOSEL 4.19 21/21] btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210502140517.2719912-19-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=hulkci@huawei.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-phy@lists.infradead.org \
    --cc=stable@vger.kernel.org \
    --cc=vkoul@kernel.org \
    --cc=yangyingliang@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).