[PATCH RESEND] misc: ti-st: st_kim: Fix use after free bug in kim_remove due to race condition

From: Zheng Wang <zyytlz.wz@163.com>
To: arnd@arndb.de
Cc: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org,
	hackerzheng666@gmail.com, 1395428693sheep@gmail.com,
	alex000young@gmail.com, Zheng Wang <zyytlz.wz@163.com>
Subject: [PATCH RESEND] misc: ti-st: st_kim: Fix use after free bug in kim_remove due to race condition
Date: Sat, 18 Mar 2023 16:17:43 +0800	[thread overview]
Message-ID: <20230318081743.797531-1-zyytlz.wz@163.com> (raw)

In kim_probe, it called st_core_init and bound &st_gdata->work_write_wakeup
with work_fn_write_wakeup.
When it calls st_tty_wakeup, it will finally call schedule_work to start
the work.

When we call kim_remove to remove the driver, there
may be a sequence as follows:

Fix it by finishing the work before cleanup in kim_remove

CPU0                  CPU1

                    |work_fn_write_wakeup
kim_remove          |
  st_core_exit      |
     kfree(st_gdata)|
                    |st_tx_wakeup
                    |//use st_gdata

Fixes: b05b7c7cc032 ("ti-st: use worker instead of calling st_int_write in wake up")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
 drivers/misc/ti-st/st_kim.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index f2f6cab97c08..160258a78c7b 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -785,9 +785,12 @@ static int kim_remove(struct platform_device *pdev)
 	/* free the GPIOs requested */
 	struct ti_st_plat_data	*pdata = pdev->dev.platform_data;
 	struct kim_data_s	*kim_gdata;
+	struct st_data_s *st_gdata = kim_gdata->core_data;
 
 	kim_gdata = platform_get_drvdata(pdev);
 
+	cancel_work_sync(&st_gdata->work_write_wakeup);
+
 	/*
 	 * Free the Bluetooth/FM/GPIO
 	 * nShutdown gpio from the system
@@ -800,7 +803,7 @@ static int kim_remove(struct platform_device *pdev)
 	pr_info("sysfs entries removed");
 
 	kim_gdata->kim_pdev = NULL;
-	st_core_exit(kim_gdata->core_data);
+	st_core_exit(st_gdata);
 
 	kfree(kim_gdata);
 	kim_gdata = NULL;
-- 
2.25.1

