From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_2 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35C05C2D0C0 for ; Mon, 9 Dec 2019 01:40:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0A888206DB for ; Mon, 9 Dec 2019 01:40:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726874AbfLIBkn (ORCPT ); Sun, 8 Dec 2019 20:40:43 -0500 Received: from mga17.intel.com ([192.55.52.151]:45255 "EHLO mga17.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726635AbfLIBkn (ORCPT ); Sun, 8 Dec 2019 20:40:43 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Dec 2019 17:40:35 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.69,293,1571727600"; d="scan'208";a="206735287" Received: from rzhang1-mobile.sh.intel.com ([10.239.195.243]) by orsmga008.jf.intel.com with ESMTP; 08 Dec 2019 17:40:32 -0800 Message-ID: <2a37f59cd86d75258ac7257a23132d6ebfbcea70.camel@intel.com> Subject: Re: [PATCH 3.16 43/72] thermal: Fix use-after-free when unregistering thermal zone device From: Zhang Rui To: Ben Hutchings , Ido Schimmel Cc: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" , "akpm@linux-foundation.org" , Denis Kirjanov , Jiri Pirko , "wvw@google.com" Date: Mon, 09 Dec 2019 09:40:37 +0800 In-Reply-To: <92faedffaa625da9d385a6af2e554d8e4744fa7a.camel@decadent.org.uk> References: <20191208162216.GA330015@splinter> <92faedffaa625da9d385a6af2e554d8e4744fa7a.camel@decadent.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.28.5-0ubuntu0.18.04.1 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, 2019-12-08 at 18:09 +0000, Ben Hutchings wrote: > On Sun, 2019-12-08 at 16:22 +0000, Ido Schimmel wrote: > > On Sun, Dec 08, 2019 at 01:53:27PM +0000, Ben Hutchings wrote: > > > 3.16.79-rc1 review patch. If anyone has any objections, please > > > let me know. > > > > > > ------------------ > > > > > > From: Ido Schimmel > > > > > > commit 1851799e1d2978f68eea5d9dff322e121dcf59c1 upstream. > > > > > > thermal_zone_device_unregister() cancels the delayed work that > > > polls the > > > thermal zone, but it does not wait for it to finish. This is racy > > > with > > > respect to the freeing of the thermal zone device, which can > > > result in a > > > use-after-free [1]. > > > > > > Fix this by waiting for the delayed work to finish before freeing > > > the > > > thermal zone device. Note that thermal_zone_device_set_polling() > > > is > > > never invoked from an atomic context, so it is safe to call > > > cancel_delayed_work_sync() that can block. > > > > Ben, > > > > Wei Wang (copied) found a problem with this patch and fixed it: > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=163b00cde7cf2206e248789d2780121ad5e6a70b > > > > I believe you should take both patches to your tree. > > Thanks, I will add that now that it is in Linus's tree. > yes, please do, thanks! -rui > Ben. >