summaryrefslogtreecommitdiff
path: root/drivers/iio
diff options
context:
space:
mode:
authorSven Van Asbroeck <thesven73@gmail.com>2019-03-10 14:58:24 -0400
committerJonathan Cameron <Jonathan.Cameron@huawei.com>2019-03-16 15:48:30 +0000
commit62039b6aef63380ba7a37c113bbaeee8a55c5342 (patch)
tree2d5c5fa8de8ccc3d56a1dafb07865ebe07461548 /drivers/iio
parent06003531502d06bc89d32528f6ec96bf978790f9 (diff)
iio: adc: xilinx: fix potential use-after-free on remove
When cancel_delayed_work() returns, the delayed work may still be running. This means that the core could potentially free the private structure (struct xadc) while the delayed work is still using it. This is a potential use-after-free. Fix by calling cancel_delayed_work_sync(), which waits for any residual work to finish before returning. Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Diffstat (limited to 'drivers/iio')
-rw-r--r--drivers/iio/adc/xilinx-xadc-core.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index b13c61539d46..ef3afaeed194 100644
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -1322,7 +1322,7 @@ static int xadc_remove(struct platform_device *pdev)
}
free_irq(xadc->irq, indio_dev);
clk_disable_unprepare(xadc->clk);
- cancel_delayed_work(&xadc->zynq_unmask_work);
+ cancel_delayed_work_sync(&xadc->zynq_unmask_work);
kfree(xadc->data);
kfree(indio_dev->channels);