On Tue, 13 Apr 2021 at 17:54, Wei Yongjun <weiyongjun1@xxxxxxxxxx> wrote:
>
> This driver's remove path calls del_timer(). However, that function
> does not wait until the timer handler finishes. This means that the
> timer handler may still be running after the driver's remove function
> has finished, which would result in a use-after-free.
>
> Fix by calling del_timer_sync(), which makes sure the timer handler
> has finished, and unable to re-schedule itself.
>
> Fixes: 8562d4fe34a3 ("mhi: pci_generic: Add health-check")
> Reported-by: Hulk Robot <hulkci@xxxxxxxxxx>
> Signed-off-by: Wei Yongjun <weiyongjun1@xxxxxxxxxx>
Reviewed-by: Loic Poulain <loic.poulain@xxxxxxxxxx>
