| From 14afeb58e0c007b4e48840d151ad780c02c183ad Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 11 May 2021 15:04:51 +0800 |
| Subject: watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff() |
| |
| From: Zou Wei <zou_wei@huawei.com> |
| |
| [ Upstream commit 90b7c141132244e8e49a34a4c1e445cce33e07f4 ] |
| |
| This module's remove path calls del_timer(). However, that function |
| does not wait until the timer handler finishes. This means that the |
| timer handler may still be running after the driver's remove function |
| has finished, which would result in a use-after-free. |
| |
| Fix by calling del_timer_sync(), which makes sure the timer handler |
| has finished, and unable to re-schedule itself. |
| |
| Reported-by: Hulk Robot <hulkci@huawei.com> |
| Signed-off-by: Zou Wei <zou_wei@huawei.com> |
| Reviewed-by: Guenter Roeck <linux@roeck-us.net> |
| Link: https://lore.kernel.org/r/1620716691-108460-1-git-send-email-zou_wei@huawei.com |
| Signed-off-by: Guenter Roeck <linux@roeck-us.net> |
| Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/watchdog/sc520_wdt.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/watchdog/sc520_wdt.c b/drivers/watchdog/sc520_wdt.c |
| index e66e6b905964..ca65468f4b9c 100644 |
| --- a/drivers/watchdog/sc520_wdt.c |
| +++ b/drivers/watchdog/sc520_wdt.c |
| @@ -186,7 +186,7 @@ static int wdt_startup(void) |
| static int wdt_turnoff(void) |
| { |
| /* Stop the timer */ |
| - del_timer(&timer); |
| + del_timer_sync(&timer); |
| |
| /* Stop the watchdog */ |
| wdt_config(0); |
| -- |
| 2.30.2 |
| |
