Hi,
On Thu, Sep 19, 2019 at 11:11:37AM -0400, Sven Van Asbroeck wrote:
> This driver's remove path calls cancel_delayed_work().
> However, that function does not wait until the work function
> finishes. This could mean that the work function is still
> running after the driver's remove function has finished,
> which would result in a use-after-free.
>
> Fix by calling cancel_delayed_work_sync(), which ensures that
> that the work is properly cancelled, no longer running, and
> unable to re-schedule itself.
>
> This issue was detected with the help of Coccinelle.
>
> Cc: stable <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Sven Van Asbroeck <TheSven73@xxxxxxxxx>
> ---
Thanks, queued.
-- Sebastian
> drivers/power/supply/ltc2941-battery-gauge.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/power/supply/ltc2941-battery-gauge.c b/drivers/power/supply/ltc2941-battery-gauge.c
> index da49436176cd..30a9014b2f95 100644
> --- a/drivers/power/supply/ltc2941-battery-gauge.c
> +++ b/drivers/power/supply/ltc2941-battery-gauge.c
> @@ -449,7 +449,7 @@ static int ltc294x_i2c_remove(struct i2c_client *client)
> {
> struct ltc294x_info *info = i2c_get_clientdata(client);
>
> - cancel_delayed_work(&info->work);
> + cancel_delayed_work_sync(&info->work);
> power_supply_unregister(info->supply);
> return 0;
> }
> --
> 2.17.1
>
Attachment:
signature.asc
Description: PGP signature
