• Zheng Wang's avatar
    xirc2ps_cs: Fix use after free bug in xirc2ps_detach · e8d20c3d
    Zheng Wang authored
    In xirc2ps_probe, the local->tx_timeout_task was bounded
    with xirc2ps_tx_timeout_task. When timeout occurs,
    it will call xirc_tx_timeout->schedule_work to start the
    work.
    
    When we call xirc2ps_detach to remove the driver, there
    may be a sequence as follows:
    
    Stop responding to timeout tasks and complete scheduled
    tasks before cleanup in xirc2ps_detach, which will fix
    the problem.
    
    CPU0                  CPU1
    
                        |xirc2ps_tx_timeout_task
    xirc2ps_detach      |
      free_netdev       |
        kfree(dev);     |
                        |
                        | do_reset
                        |   //use dev
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarZheng Wang <zyytlz.wz@163.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e8d20c3d
xirc2ps_cs.c 52.1 KB