| From 19495f0e07f2934675490e2aad6133fa7bd7c51e Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 11 May 2021 15:01:35 +0800 |
| Subject: watchdog: Fix possible use-after-free in wdt_startup() |
| |
| From: Zou Wei <zou_wei@huawei.com> |
| |
| [ Upstream commit c08a6b31e4917034f0ed0cb457c3bb209576f542 ] |
| |
| This module's remove path calls del_timer(). However, that function |
| does not wait until the timer handler finishes. This means that the |
| timer handler may still be running after the driver's remove function |
| has finished, which would result in a use-after-free. |
| |
| Fix by calling del_timer_sync(), which makes sure the timer handler |
| has finished, and unable to re-schedule itself. |
| |
| Reported-by: Hulk Robot <hulkci@huawei.com> |
| Signed-off-by: Zou Wei <zou_wei@huawei.com> |
| Reviewed-by: Guenter Roeck <linux@roeck-us.net> |
| Link: https://lore.kernel.org/r/1620716495-108352-1-git-send-email-zou_wei@huawei.com |
| Signed-off-by: Guenter Roeck <linux@roeck-us.net> |
| Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/watchdog/sbc60xxwdt.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/watchdog/sbc60xxwdt.c b/drivers/watchdog/sbc60xxwdt.c |
| index a947a63fb44a..7b974802dfc7 100644 |
| --- a/drivers/watchdog/sbc60xxwdt.c |
| +++ b/drivers/watchdog/sbc60xxwdt.c |
| @@ -146,7 +146,7 @@ static void wdt_startup(void) |
| static void wdt_turnoff(void) |
| { |
| /* Stop the timer */ |
| - del_timer(&timer); |
| + del_timer_sync(&timer); |
| inb_p(wdt_stop); |
| pr_info("Watchdog timer is now disabled...\n"); |
| } |
| -- |
| 2.30.2 |
| |
