A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 11:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

atm: iphase: fix possible use-after-free in ia_module_exit()

Browse source 
[ Upstream commit 1c72e6ab66b9598cac741ed397438a52065a8f1f ]

This module's remove path calls del_timer(). However, that function
does not wait until the timer handler finishes. This means that the
timer handler may still be running after the driver's remove function
has finished, which would result in a use-after-free.

Fix by calling del_timer_sync(), which makes sure the timer handler
has finished, and unable to re-schedule itself.

Reported-by: Hulk Robot <[email protected]>
Signed-off-by: Zou Wei <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
This commit is contained in:
Zou Wei 2021-05-11 14:53:36 +08:00 • committed by Greg Kroah-Hartman
commit c9172498d4
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/atm/iphase.c
View file

@ -3295,7 +3295,7 @@ static void __exit ia_module_exit(void)
{
pci_unregister_driver(&ia_driver);
del_timer(&ia_timer);
del_timer_sync(&ia_timer);
}
module_init(ia_module_init);