phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
authorYang Yingliang <yangyingliang@huawei.com>
Wed, 7 Apr 2021 09:27:16 +0000 (17:27 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 16 Apr 2021 05:27:19 +0000 (07:27 +0200)
commite1723d8b87b73ab363256e7ca3af3ddb75855680
treee312c2e70f1447f1bc1f82f7d081eee5df08a588
parent41c9f7fb64f8423750b0ccd916a8a3cf4f5c99c1
phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()

This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210407092716.3270248-1-yangyingliang@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/phy/ti/phy-twl4030-usb.c