summaryrefslogtreecommitdiff
path: root/drivers/phy
diff options
context:
space:
mode:
authorYang Yingliang <yangyingliang@huawei.com>2021-04-07 12:27:16 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2021-04-16 08:27:19 +0300
commite1723d8b87b73ab363256e7ca3af3ddb75855680 (patch)
treee312c2e70f1447f1bc1f82f7d081eee5df08a588 /drivers/phy
parent41c9f7fb64f8423750b0ccd916a8a3cf4f5c99c1 (diff)
downloadlinux-e1723d8b87b73ab363256e7ca3af3ddb75855680.tar.xz
phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
This driver's remove path calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20210407092716.3270248-1-yangyingliang@huawei.com Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/phy')
-rw-r--r--drivers/phy/ti/phy-twl4030-usb.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c
index 9887f908f540..812e5409d359 100644
--- a/drivers/phy/ti/phy-twl4030-usb.c
+++ b/drivers/phy/ti/phy-twl4030-usb.c
@@ -779,7 +779,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)
usb_remove_phy(&twl->phy);
pm_runtime_get_sync(twl->dev);
- cancel_delayed_work(&twl->id_workaround_work);
+ cancel_delayed_work_sync(&twl->id_workaround_work);
device_remove_file(twl->dev, &dev_attr_vbus);
/* set transceiver mode to power on defaults */