Hello,
On 11/28/24 08:45, Pei Xiao wrote:
> at91_adc_interrupt can call at91_adc_touch_data_handler function
> to start the work by schedule_work(&st->touch_st.workq).
>
> If we remove the module which will call at91_adc_remove to
> make cleanup, it will free indio_dev through iio_device_unregister
> while the work mentioned above will be used. The sequence of operations
> that may lead to a UAF bug is as follows:
>
> CPU0 CPU1
>
> | at91_adc_workq_handler
> at91_adc_remove |
> iio_device_unregister(indio_dev) |
> device_release |
> //free indio_dev |
> | iio_push_to_buffers(indio_dev)
> | //use indio_dev
>
> Fix it by ensuring that the work is canceled before proceeding with
> the cleanup in at91_adc_remove.
>
> Fixes: 27e177190891 ("iio:adc:at91_adc8xx: introduce new atmel adc driver")
I believe that the commit that introduced the workqueue is different
than the one you tagged here.
With that changed,
Reviewed-by: Eugen Hristev <eugen.hristev@xxxxxxxxxx>
> Signed-off-by: Pei Xiao <xiaopei01@xxxxxxxxxx>
> ---
> drivers/iio/adc/at91-sama5d2_adc.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c
> index 8e5aaf15a921..4ba52b500054 100644
> --- a/drivers/iio/adc/at91-sama5d2_adc.c
> +++ b/drivers/iio/adc/at91-sama5d2_adc.c
> @@ -2491,6 +2491,7 @@ static void at91_adc_remove(struct platform_device *pdev)
> struct iio_dev *indio_dev = platform_get_drvdata(pdev);
> struct at91_adc_state *st = iio_priv(indio_dev);
>
> + cancel_work_sync(&st->touch_st.workq);
> iio_device_unregister(indio_dev);
>
> at91_adc_dma_disable(st);
