| From a459abc28d9f5e41593e14d16cd46e2d5c5be3b2 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 12 May 2021 14:57:56 +0800 |
| Subject: watchdog: Fix possible use-after-free by calling del_timer_sync() |
| |
| From: Zou Wei <zou_wei@huawei.com> |
| |
| [ Upstream commit d0212f095ab56672f6f36aabc605bda205e1e0bf ] |
| |
| This driver's remove path calls del_timer(). However, that function |
| does not wait until the timer handler finishes. This means that the |
| timer handler may still be running after the driver's remove function |
| has finished, which would result in a use-after-free. |
| |
| Fix by calling del_timer_sync(), which makes sure the timer handler |
| has finished, and unable to re-schedule itself. |
| |
| Reported-by: Hulk Robot <hulkci@huawei.com> |
| Signed-off-by: Zou Wei <zou_wei@huawei.com> |
| Reviewed-by: Guenter Roeck <linux@roeck-us.net> |
| Acked-by: Vladimir Zapolskiy <vz@mleia.com> |
| Link: https://lore.kernel.org/r/1620802676-19701-1-git-send-email-zou_wei@huawei.com |
| Signed-off-by: Guenter Roeck <linux@roeck-us.net> |
| Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/watchdog/lpc18xx_wdt.c | 2 +- |
| drivers/watchdog/w83877f_wdt.c | 2 +- |
| 2 files changed, 2 insertions(+), 2 deletions(-) |
| |
| diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c |
| index 78cf11c94941..60b6d74f267d 100644 |
| --- a/drivers/watchdog/lpc18xx_wdt.c |
| +++ b/drivers/watchdog/lpc18xx_wdt.c |
| @@ -292,7 +292,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev) |
| struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev); |
| |
| dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n"); |
| - del_timer(&lpc18xx_wdt->timer); |
| + del_timer_sync(&lpc18xx_wdt->timer); |
| |
| return 0; |
| } |
| diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c |
| index 5772cc5d3780..f2650863fd02 100644 |
| --- a/drivers/watchdog/w83877f_wdt.c |
| +++ b/drivers/watchdog/w83877f_wdt.c |
| @@ -166,7 +166,7 @@ static void wdt_startup(void) |
| static void wdt_turnoff(void) |
| { |
| /* Stop the timer */ |
| - del_timer(&timer); |
| + del_timer_sync(&timer); |
| |
| wdt_change(WDT_DISABLE); |
| |
| -- |
| 2.30.2 |
| |