diff mbox series

[v2] misc: ti-st: st_kim: Fix use after free bug in kim_remove due to race condition

Message ID 20230320062435.500109-1-zyytlz.wz@163.com
State New
Headers
Series [v2] misc: ti-st: st_kim: Fix use after free bug in kim_remove due to race condition |

Commit Message

Zheng Wang March 20, 2023, 6:24 a.m. UTC 
  In kim_probe, it called st_core_init and bound &st_gdata->work_write_wakeup
with work_fn_write_wakeup.
When it calls st_tty_wakeup, it will finally call schedule_work to start
the work.

When we call kim_remove to remove the driver, there
may be a sequence as follows:

Fix it by finishing the work before cleanup in kim_remove

CPU0                  CPU1

                    |work_fn_write_wakeup
kim_remove          |
  st_core_exit      |
     kfree(st_gdata)|
                    |st_tx_wakeup
                    |//use st_gdata

Fixes: b05b7c7cc032 ("ti-st: use worker instead of calling st_int_write in wake up")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
v2:
- fix error from kernek_test-robot
---
 drivers/misc/ti-st/st_kim.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index f2f6cab97c08..497ba8d8df27 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -785,8 +785,12 @@  static int kim_remove(struct platform_device *pdev)
 	/* free the GPIOs requested */
 	struct ti_st_plat_data	*pdata = pdev->dev.platform_data;
 	struct kim_data_s	*kim_gdata;
+	struct st_data_s *st_gdata;
 
 	kim_gdata = platform_get_drvdata(pdev);
+	st_gdata = kim_gdata->core_data;
+
+	cancel_work_sync(&st_gdata->work_write_wakeup);
 
 	/*
 	 * Free the Bluetooth/FM/GPIO
@@ -800,7 +804,7 @@  static int kim_remove(struct platform_device *pdev)
 	pr_info("sysfs entries removed");
 
 	kim_gdata->kim_pdev = NULL;
-	st_core_exit(kim_gdata->core_data);
+	st_core_exit(st_gdata);
 
 	kfree(kim_gdata);
 	kim_gdata = NULL;