From 0668e8ccd33122a350629f6583c880b62b40ab5d Mon Sep 17 00:00:00 2001 From: Yang Yingliang Date: Fri, 6 May 2022 16:48:51 +0800 Subject: hte: Fix possible use-after-free in tegra_hte_test_remove() del_timer() does not wait until the timer handler finishing. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix it by calling del_timer_sync(), which makes sure the timer handler has finished. Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Reviewed-by: Dipen Patel Acked-by: Dipen Patel Signed-off-by: Thierry Reding --- drivers/hte/hte-tegra194-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hte/hte-tegra194-test.c b/drivers/hte/hte-tegra194-test.c index 6a3e57b57a34..5d776a185bd6 100644 --- a/drivers/hte/hte-tegra194-test.c +++ b/drivers/hte/hte-tegra194-test.c @@ -219,7 +219,7 @@ static int tegra_hte_test_remove(struct platform_device *pdev) free_irq(hte.gpio_in_irq, &hte); gpiod_put(hte.gpio_in); gpiod_put(hte.gpio_out); - del_timer(&hte.timer); + del_timer_sync(&hte.timer); return 0; } -- cgit v1.2.3-58-ga151