Hi, On Wed, Apr 07, 2021 at 05:17:06PM +0800, Yang Yingliang wrote: > This driver's remove path calls cancel_delayed_work(). However, that > function does not wait until the work function finishes. This means > that the callback function may still be running after the driver's > remove function has finished, which would result in a use-after-free. > > Fix by calling cancel_delayed_work_sync(), which ensures that > the work is properly cancelled, no longer running, and unable > to re-schedule itself. > > Reported-by: Hulk Robot <hul...@huawei.com> > Signed-off-by: Yang Yingliang <yangyingli...@huawei.com> > ---
Thanks, queued. -- Sebastian > drivers/power/supply/generic-adc-battery.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/power/supply/generic-adc-battery.c > b/drivers/power/supply/generic-adc-battery.c > index 0032069fbc2b..66039c665dd1 100644 > --- a/drivers/power/supply/generic-adc-battery.c > +++ b/drivers/power/supply/generic-adc-battery.c > @@ -373,7 +373,7 @@ static int gab_remove(struct platform_device *pdev) > } > > kfree(adc_bat->psy_desc.properties); > - cancel_delayed_work(&adc_bat->bat_work); > + cancel_delayed_work_sync(&adc_bat->bat_work); > return 0; > } > > -- > 2.25.1 >
signature.asc
Description: PGP signature
