From: Sven Van Asbroeck <thesven73(a)gmail.com>
[ Upstream commit 62039b6aef63380ba7a37c113bbaeee8a55c5342 ]
When cancel_delayed_work() returns, the delayed work may still
be running. This means that the core could potentially free
the private structure (struct xadc) while the delayed work
is still using it. This is a potential use-after-free.
Fix by calling cancel_delayed_work_sync(), which waits for
any residual work to finish before returning.
Signed-off-by: Sven Van Asbroeck <TheSven73(a)gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/iio/adc/xilinx-xadc-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index 4a60497a1f19..e89711b30ae8 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -1302,7 +1302,7 @@ static int xadc_remove(struct platform_device *pdev)
}
free_irq(irq, indio_dev);
clk_disable_unprepare(xadc->clk);
- cancel_delayed_work(&xadc->zynq_unmask_work);
+ cancel_delayed_work_sync(&xadc->zynq_unmask_work);
kfree(xadc->data);
kfree(indio_dev->channels);
--
2.20.1
From: Sven Van Asbroeck <thesven73(a)gmail.com>
[ Upstream commit 62039b6aef63380ba7a37c113bbaeee8a55c5342 ]
When cancel_delayed_work() returns, the delayed work may still
be running. This means that the core could potentially free
the private structure (struct xadc) while the delayed work
is still using it. This is a potential use-after-free.
Fix by calling cancel_delayed_work_sync(), which waits for
any residual work to finish before returning.
Signed-off-by: Sven Van Asbroeck <TheSven73(a)gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/iio/adc/xilinx-xadc-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index 3f6be5ac049a..1960694e8007 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -1320,7 +1320,7 @@ static int xadc_remove(struct platform_device *pdev)
}
free_irq(xadc->irq, indio_dev);
clk_disable_unprepare(xadc->clk);
- cancel_delayed_work(&xadc->zynq_unmask_work);
+ cancel_delayed_work_sync(&xadc->zynq_unmask_work);
kfree(xadc->data);
kfree(indio_dev->channels);
--
2.20.1
On Mon, May 13, 2019 at 09:56:43AM +0200, pepijn de vos wrote:
> I attached a 4.15 patch to the bugzilla issue
> https://bugzilla.kernel.org/show_bug.cgi?id=201427 which might also apply
> to earlier branches. Please let me know if any further action is needed to
> format this correctly for inclusion to the kernel.
>
> Regards,
> Pepijn de Vos
>
> On Mon, May 13, 2019 at 9:41 AM <gregkh(a)linuxfoundation.org> wrote:
>
> >
> > The patch below does not apply to the 4.14-stable tree.
> > If someone wants it applied there, or to any other stable or longterm
> > tree, then please email the backport, including the original git commit
> > id to <stable(a)vger.kernel.org>.
> >
> > thanks,
> >
> > greg k-h
> >
> > ------------------ original commit in Linus's tree ------------------
> >
> > From 6cc13c28da5beee0f706db6450e190709700b34a Mon Sep 17 00:00:00 2001
> > From: Mario Limonciello <mario.limonciello(a)dell.com>
> > Date: Wed, 27 Mar 2019 09:25:34 -0500
> > Subject: [PATCH] platform/x86: dell-laptop: fix rfkill functionality
> > MIME-Version: 1.0
> > Content-Type: text/plain; charset=UTF-8
> > Content-Transfer-Encoding: 8bit
> >
> > When converting the driver two arguments were transposed leading
> > to rfkill not working.
> >
> > BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201427
> > Reported-by: Pepijn de Vos <pepijndevos(a)gmail.com>
> > Fixes: 549b49 ("platform/x86: dell-smbios: Introduce dispatcher for SMM
> > calls")
> > Signed-off-by: Mario Limonciello <mario.limonciello(a)dell.com>
> > Acked-by: Pali Rohár <pali.rohar(a)gmail.com>
> > Cc: <stable(a)vger.kernel.org> # 4.14.x
The problem is this says "4.14.x", yet 549b4930f057 ("platform/x86:
dell-smbios: Introduce dispatcher for SMM calls") was not in the tree
until 4.15, so I don't see how this would work on 4.14.
Daren?