From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.14 26/27] auxdisplay: ht16k33: fix potential user-after-free on module unload
Date: Mon, 11 Mar 2019 15:58:23 -0400 [thread overview]
Message-ID: <20190311195824.139043-26-sashal@kernel.org> (raw)
In-Reply-To: <20190311195824.139043-1-sashal@kernel.org>
From: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
[ Upstream commit 69ef9bc54715fb1cb7786ada15774e469e822209 ]
On module unload/remove, we need to ensure that work does not run
after we have freed resources. Concretely, cancel_delayed_work()
may return while the callback function is still running.
From kernel/workqueue.c:
The work callback function may still be running on return,
unless it returns true and the work doesn't re-arm itself.
Explicitly flush or use cancel_delayed_work_sync() to wait on it.
Link: https://lore.kernel.org/lkml/20190204220952.30761-1-TheSven73@googlemail.com/
Reported-by: Sven Van Asbroeck <thesven73@gmail.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Sven Van Asbroeck <TheSven73@gmail.com>
Acked-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/auxdisplay/ht16k33.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
index fbfa5b4cc567..a93ded300740 100644
--- a/drivers/auxdisplay/ht16k33.c
+++ b/drivers/auxdisplay/ht16k33.c
@@ -517,7 +517,7 @@ static int ht16k33_remove(struct i2c_client *client)
struct ht16k33_priv *priv = i2c_get_clientdata(client);
struct ht16k33_fbdev *fbdev = &priv->fbdev;
- cancel_delayed_work(&fbdev->work);
+ cancel_delayed_work_sync(&fbdev->work);
unregister_framebuffer(fbdev->info);
framebuffer_release(fbdev->info);
free_page((unsigned long) fbdev->buffer);
--
2.19.1
next prev parent reply other threads:[~2019-03-11 19:59 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-11 19:57 [PATCH AUTOSEL 4.14 01/27] drm/imx: ignore plane updates on disabled crtcs Sasha Levin
2019-03-11 19:57 ` [PATCH AUTOSEL 4.14 02/27] gpu: ipu-v3: Fix i.MX51 CSI control registers offset Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 03/27] drm/imx: imx-ldb: add missing of_node_puts Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 04/27] gpu: ipu-v3: Fix CSI offsets for imx53 Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 05/27] s390/dasd: fix using offset into zero size array error Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 06/27] Input: pwm-vibra - prevent unbalanced regulator Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 07/27] Input: pwm-vibra - stop regulator after disabling pwm, not before Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 08/27] ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 09/27] ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 10/27] ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 11/27] KVM: arm/arm64: Reset the VCPU without preemption and vcpu state loaded Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 12/27] ARM: OMAP2+: fix lack of timer interrupts on CPU1 after hotplug Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 13/27] Input: cap11xx - switch to using set_brightness_blocking() Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 14/27] Input: ps2-gpio - flush TX work when closing port Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 15/27] Input: matrix_keypad - use flush_delayed_work() Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 16/27] mac80211: Fix Tx aggregation session tear down with ITXQs Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 17/27] ipvs: fix dependency on nf_defrag_ipv6 Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 18/27] floppy: check_events callback should not return a negative number Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 19/27] NFS: Don't use page_file_mapping after removing the page Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 20/27] mm/gup: fix gup_pmd_range() for dax Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 21/27] Revert "mm: use early_pfn_to_nid in page_ext_init" Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 22/27] mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 23/27] net: hns: Fix object reference leaks in hns_dsaf_roce_reset() Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 24/27] i2c: cadence: Fix the hold bit setting Sasha Levin
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 25/27] i2c: bcm2835: Clear current buffer pointers and counts after a transfer Sasha Levin
2019-03-11 19:58 ` Sasha Levin [this message]
2019-03-11 19:58 ` [PATCH AUTOSEL 4.14 27/27] Input: st-keyscan - fix potential zalloc NULL dereference Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190311195824.139043-26-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=miguel.ojeda.sandonis@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox