On Sun, Jun 06, 2021 at 09:07:40PM +0530, Manivannan Sadhasivam wrote:
> From: Wei Yongjun <weiyongjun1@xxxxxxxxxx>
>
> This driver's remove path calls del_timer(). However, that function
> does not wait until the timer handler finishes. This means that the
> timer handler may still be running after the driver's remove function
> has finished, which would result in a use-after-free.
>
> Fix by calling del_timer_sync(), which makes sure the timer handler
> has finished, and unable to re-schedule itself.
>
> Fixes: 8562d4fe34a3 ("mhi: pci_generic: Add health-check")
> Reported-by: Hulk Robot <hulkci@xxxxxxxxxx>
> Signed-off-by: Wei Yongjun <weiyongjun1@xxxxxxxxxx>
> Reviewed-by: Hemant kumar <hemantk@xxxxxxxxxxxxxx>
> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxx>
> Reviewed-by: Loic Poulain <loic.poulain@xxxxxxxxxx>
> Link: https://lore.kernel.org/r/20210413160318.2003699-1-weiyongjun1@xxxxxxxxxx
> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxx>
> ---
> drivers/bus/mhi/pci_generic.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
No Cc: stable on this? I'll go add it...
