mirror of
https://github.com/torvalds/linux.git
synced 2024-11-11 14:42:24 +00:00
11362b7a43
This driver's probe() uses a mix of devm_ and non-devm_ functions. This means that the remove order will not be the exact opposite of the probe order. Remove order: 1. remove() executes: iio_device_unregister iio_triggered_buffer_cleanup iio_trigger_unregister (A) 2. core frees devm resources in reverse order: free_irq iio_trigger_free iio_device_free In (A) the trigger has been unregistered, but the irq handler is still registered and active, so the trigger may still be touched via interrupt -> as3935_event_work. This is a potential use-after-unregister. Given that the delayed work is never canceled explicitly, it may run even after iio_device_free. This is a potential use-after-free. Solution: convert all probe functions to their devm_ equivalents. Add a devm callback, called by the core on remove right after irq_free, which explicitly cancels the delayed work. This will guarantee that all resources are freed in the correct order. As an added bonus, some boilerplate code can be removed. Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> |
||
|---|---|---|
| .. | ||
| as3935.c | ||
| isl29501.c | ||
| Kconfig | ||
| Makefile | ||
| pulsedlight-lidar-lite-v2.c | ||
| rfd77402.c | ||
| srf04.c | ||
| srf08.c | ||
| sx9500.c | ||
| vl53l0x-i2c.c | ||