diff options
| author | Reka Norman <rekanorman@chromium.org> | 2023-02-27 05:49:38 +0300 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2023-03-03 17:06:11 +0300 |
| commit | 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 (patch) | |
| tree | f3397f7ce08e9f227b65be0b84604ac98f8ce3ca /include | |
| parent | db50f7a3983f0154e730f1147ef729e0c5c2f90c (diff) | |
| download | linux-8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785.tar.xz | |
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
When a reset notify IPC message is received, the ISR schedules a work
function and passes the ISHTP device to it via a global pointer
ishtp_dev. If ish_probe() fails, the devm-managed device resources
including ishtp_dev are freed, but the work is not cancelled, causing a
use-after-free when the work function tries to access ishtp_dev. Use
devm_work_autocancel() instead, so that the work is automatically
cancelled if probe fails.
Signed-off-by: Reka Norman <rekanorman@chromium.org>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions