From patchwork Fri Mar 10 08:40:07 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zheng Wang X-Patchwork-Id: 67291 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp766789wrd; Fri, 10 Mar 2023 01:17:13 -0800 (PST) X-Google-Smtp-Source: AK7set/7frnLLUzimknWlppqYl92t+JWWmtGJDSOeLCpfNs6QR89Q4qGZpcK4wRov/I6Ye3D50Uf X-Received: by 2002:a17:902:d4cc:b0:19d:af20:3fe8 with SMTP id o12-20020a170902d4cc00b0019daf203fe8mr30033264plg.21.1678439832782; Fri, 10 Mar 2023 01:17:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678439832; cv=none; d=google.com; s=arc-20160816; b=0CiMA4KrKAaeuI8zNxqVYXFjfNfovkG2IEisqF9VkBzxLKqmTivt8swJJAdSPAetP1 drSzkZn801R0XCg+qOu/eHsuG4UMjcg6xtWNaJyG6etiByAdRDTBHqEx++/mnSeMjg41 NqKGSvAuwria3W8CNZetzifHxrzp+T5zaNXKyrg3A21ZwylmdmFGvXMoo7ePY0I88Ae6 xZYbQye6AV7GSg6PQ7udrGR4+/ZZRE+hSoWYMI9hLcVGYJ4EPXPf/DPUK8d0GB+aQw/M vcLRqi+56yJj+3D0O7ZFKxpSNAuoysIR/PRlMnwCMg4bfgckrmckpOnDd6v4GZDoB1bM 2/vA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=YFT7zs16vbeLcGevQfrFZe7wYgMysfsx9rVuRnnFefk=; b=mEZKedlw7ady7+p837yxwzLKLmuiEi6si4Pko151d4SkOw42CKBfH6hq6MkQ/N01AS 7wcMd+7nD0rrTvVPRZFFniYtX7H5Je0Aw970W6k/KW58vTZS5CYe7K4ESccR02sNO058 dvV4doPRd9G3ij3JLRlGcSf4T+/AhANLAuYlCnLjLIV/DwzIXc7bBrDTSbs9fAEDqsFX cgspwwXzFvkFsxlXz6LftHUBgdrYVyeeURw14CH0D1/l5K3i8XBPOw/EoUEbfv/mKwoU H2IFlC2wimRQSEWiaaj7GSuo2tiru7vrSBlyDtn2fkM5y6rgOoJSuYbIBwYOBjuloD3I jKbA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=Tuhp30Nu; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id d4-20020a170903230400b00182d9015d42si1648866plh.225.2023.03.10.01.16.59; Fri, 10 Mar 2023 01:17:12 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=Tuhp30Nu; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231193AbjCJIme (ORCPT + 99 others); Fri, 10 Mar 2023 03:42:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60146 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231180AbjCJIl5 (ORCPT ); Fri, 10 Mar 2023 03:41:57 -0500 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.215]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id D2B7E10BA55; Fri, 10 Mar 2023 00:40:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=YFT7z s16vbeLcGevQfrFZe7wYgMysfsx9rVuRnnFefk=; b=Tuhp30NuRknZDAJjrEiFi o7sulbqQ4faqqSTDrth4OIPPyIHq/BFdDBOB3IJAslmTPV0uw+T+eqTq5HOAGh9M +e8QNk67kULt91hrOaDFStMVGbGXkPkaZhLE8EyeFqkyvSk9TovjnIGmZTdUDSp9 ibDXDaq6gJXcNLZQGp1vL0= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by zwqz-smtp-mta-g4-1 (Coremail) with SMTP id _____wBHbX7o7ApkQrpHCw--.4153S2; Fri, 10 Mar 2023 16:40:08 +0800 (CST) From: Zheng Wang To: jdelvare@suse.com Cc: linux@roeck-us.net, linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org, hackerzheng666@gmail.com, 1395428693sheep@gmail.com, alex000young@gmail.com, Zheng Wang Subject: [PATCH] hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition Date: Fri, 10 Mar 2023 16:40:07 +0800 Message-Id: <20230310084007.1403388-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CM-TRANSID: _____wBHbX7o7ApkQrpHCw--.4153S2 X-Coremail-Antispam: 1Uf129KBjvdXoW7JryfJr4xWw1DGF4rZrWrXwb_yoWkKrc_uF Wj9FyxWrn8Crn8Ar4qkFnxZrWkKFnYgr47tF4Sy3y5A34agw15X398A3Z7Z348G3y5GFy5 uw4jkFWrury7ZjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7sRErgAUUUUUU== X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiQg4uU1aEEnKxTQAAs- X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759971726306238852?= X-GMAIL-MSGID: =?utf-8?q?1759971726306238852?= In xgene_hwmon_probe, &ctx->workq is bound with xgene_hwmon_evt_work. Then it will be started. If we remove the driver which will call xgene_hwmon_remove to make cleanup, there may be a unfinished work. The possiblesequence is as follows: Fix it by finishing the work before cleanup in the xgene_hwmon_remove CPU0 CPU1 |xgene_hwmon_evt_work xgene_hwmon_remove | kfifo_free(&ctx->async_msg_fifo);| | |kfifo_out_spinlocked |//use &ctx->async_msg_fifo Fixes: 2ca492e22cb7 ("hwmon: (xgene) Fix crash when alarm occurs before driver probe") Signed-off-by: Zheng Wang --- drivers/hwmon/xgene-hwmon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c index 5cde837bfd09..d1abea49f01b 100644 --- a/drivers/hwmon/xgene-hwmon.c +++ b/drivers/hwmon/xgene-hwmon.c @@ -761,6 +761,7 @@ static int xgene_hwmon_remove(struct platform_device *pdev) { struct xgene_hwmon_dev *ctx = platform_get_drvdata(pdev); + cancel_work_sync(&ctx->workq); hwmon_device_unregister(ctx->hwmon_dev); kfifo_free(&ctx->async_msg_fifo); if (acpi_disabled)