Skip to content

Commit

Permalink
sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
Browse files Browse the repository at this point in the history
The original code puts flush_work() before timer_shutdown_sync()
in switch_drv_remove(). Although we use flush_work() to stop
the worker, it could be rescheduled in switch_timer(). As a result,
a use-after-free bug can occur. The details are shown below:

      (cpu 0)                    |      (cpu 1)
switch_drv_remove()              |
 flush_work()                    |
  ...                            |  switch_timer // timer
                                 |   schedule_work(&psw->work)
 timer_shutdown_sync()           |
 ...                             |  switch_work_handler // worker
 kfree(psw) // free              |
                                 |   psw->state = 0 // use

This patch puts timer_shutdown_sync() before flush_work() to
mitigate the bugs. As a result, the worker and timer will be
stopped safely before the deallocate operations.

Fixes: 9f5e8ee ("sh: generic push-switch framework.")
Signed-off-by: Duoming Zhou <[email protected]>
Reviewed-by: Geert Uytterhoeven <[email protected]>
Reviewed-by: John Paul Adrian Glaubitz <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: John Paul Adrian Glaubitz <[email protected]>
  • Loading branch information
stonezdm authored and glaubitz committed Sep 9, 2023
1 parent fb60211 commit 246f80a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion arch/sh/drivers/push-switch.c
Original file line number Diff line number Diff line change
Expand Up @@ -101,8 +101,8 @@ static int switch_drv_remove(struct platform_device *pdev)
device_remove_file(&pdev->dev, &dev_attr_switch);

platform_set_drvdata(pdev, NULL);
flush_work(&psw->work);
timer_shutdown_sync(&psw->debounce);
flush_work(&psw->work);
free_irq(irq, pdev);

kfree(psw);
Expand Down

0 comments on commit 246f80a

Please sign in to comment.