From: Zou Wei zou_wei@huawei.com
stable inclusion from stable-5.10.51 commit a7f7c42e31157d1f0871d6a8e1a0b73a6b4ea785 bugzilla: 175263 https://gitee.com/openeuler/kernel/issues/I4DT6F
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit 34e7434ba4e97f4b85c1423a59b2922ba7dff2ea ]
This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free.
Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.
Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Zou Wei zou_wei@huawei.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Chen Jun chenjun102@huawei.com Acked-by: Weilong Chen chenweilong@huawei.com Signed-off-by: Chen Jun chenjun102@huawei.com --- drivers/atm/nicstar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c index 09ad73361879..1351b05a3097 100644 --- a/drivers/atm/nicstar.c +++ b/drivers/atm/nicstar.c @@ -297,7 +297,7 @@ static void __exit nicstar_cleanup(void) { XPRINTK("nicstar: nicstar_cleanup() called.\n");
- del_timer(&ns_timer); + del_timer_sync(&ns_timer);
pci_unregister_driver(&nicstar_driver);