Hi, On Thu, Sep 19, 2019 at 11:11:37AM -0400, Sven Van Asbroeck wrote: > This driver's remove path calls cancel_delayed_work(). > However, that function does not wait until the work function > finishes. This could mean that the work function is still > running after the driver's remove function has finished, > which would result in a use-after-free. > > Fix by calling cancel_delayed_work_sync(), which ensures that > that the work is properly cancelled, no longer running, and > unable to re-schedule itself. > > This issue was detected with the help of Coccinelle. > > Cc: stable <[email protected]> > Signed-off-by: Sven Van Asbroeck <[email protected]> > ---
Thanks, queued.
-- Sebastian
> drivers/power/supply/ltc2941-battery-gauge.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/power/supply/ltc2941-battery-gauge.c
> b/drivers/power/supply/ltc2941-battery-gauge.c
> index da49436176cd..30a9014b2f95 100644
> --- a/drivers/power/supply/ltc2941-battery-gauge.c
> +++ b/drivers/power/supply/ltc2941-battery-gauge.c
> @@ -449,7 +449,7 @@ static int ltc294x_i2c_remove(struct i2c_client *client)
> {
> struct ltc294x_info *info = i2c_get_clientdata(client);
>
> - cancel_delayed_work(&info->work);
> + cancel_delayed_work_sync(&info->work);
> power_supply_unregister(info->supply);
> return 0;
> }
> --
> 2.17.1
>
signature.asc
Description: PGP signature
