From 7568d1fa2d1d846003340b00a29af9d6c2534db5 Mon Sep 17 00:00:00 2001 From: zpc2024 Date: Sat, 22 Apr 2023 20:09:46 +0800 Subject: [PATCH] power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition stable inclusion from stable-v5.10.0 commit 06615d11cc78162dfd5116efb71f29eb29502d37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6W80A CVE: CVE-2023-30772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=06615d11cc78162dfd5116efb71f29eb29502d37 ------------------------------------- power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition In da9150_charger_probe, &charger->otg_work is bound with da9150_charger_otg_work. da9150_charger_otg_ncb may be called to start the work. If we remove the module which will call da9150_charger_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: Fix it by canceling the work before cleanup in the da9150_charger_remove CPU0 CPUc1 |da9150_charger_otg_work da9150_charger_remove | power_supply_unregister | device_unregister | power_supply_dev_release| kfree(psy) | | | power_supply_changed(charger->usb); | //use Fixes: c1a281e34dae ("power: Add support for DA9150 Charger") Signed-off-by: Zheng Wang Signed-off-by: Sebastian Reichel Signed-off-by: zhaopengcheng --- drivers/power/supply/da9150-charger.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/power/supply/da9150-charger.c b/drivers/power/supply/da9150-charger.c index f9314cc0cd75..e4526c749bac 100644 --- a/drivers/power/supply/da9150-charger.c +++ b/drivers/power/supply/da9150-charger.c @@ -662,7 +662,8 @@ static int da9150_charger_remove(struct platform_device *pdev) if (!IS_ERR_OR_NULL(charger->usb_phy)) usb_unregister_notifier(charger->usb_phy, &charger->otg_nb); - + cancel_work_sync(&charger->otg_work); + power_supply_unregister(charger->battery); power_supply_unregister(charger->usb); -- Gitee