On Sun, 10 Mar 2019 14:58:25 -0400 Sven Van Asbroeck <thesven73@xxxxxxxxx> wrote: > If probe errors out after request_irq(), its error path > does not explicitly cancel the delayed work, which may > have been scheduled by the interrupt handler. > > This means the delayed work may still be running when > the core frees the private structure (struct xadc). > This is a potential use-after-free. > > Fix by inserting cancel_delayed_work_sync() in the probe > error path. > > Signed-off-by: Sven Van Asbroeck <TheSven73@xxxxxxxxx> Again, seems fine to me. Applied to the fixes-togreg branch of iio.git. thanks, Jonathan > --- > drivers/iio/adc/xilinx-xadc-core.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c > index 1960694e8007..15e1a103f37d 100644 > --- a/drivers/iio/adc/xilinx-xadc-core.c > +++ b/drivers/iio/adc/xilinx-xadc-core.c > @@ -1290,6 +1290,7 @@ static int xadc_probe(struct platform_device *pdev) > > err_free_irq: > free_irq(xadc->irq, indio_dev); > + cancel_delayed_work_sync(&xadc->zynq_unmask_work); > err_clk_disable_unprepare: > clk_disable_unprepare(xadc->clk); > err_free_samplerate_trigger:
