Zheng Wang 5000fe6c27 nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition ... This bug influences both st_nci_i2c_remove and st_nci_spi_remove. Take st_nci_i2c_remove as an example. In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work with llt_ndlc_sm_work. When it calls ndlc_recv or timeout handler, it will finally call schedule_work to start the work. When we call st_nci_i2c_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in ndlc_remove CPU0 CPU1 |llt_ndlc_sm_work st_nci_i2c_remove | ndlc_remove | st_nci_remove | nci_free_device| kfree(ndev) | //free ndlc->ndev | |llt_ndlc_rcv_queue |nci_recv_frame |//use ndlc->ndev Fixes: 35630df68d ("NFC: st21nfcb: Add driver for STMicroelectronics ST21NFCB NFC chip") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20230312160837.2040857-1-zyytlz.wz@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2023-03-15 00:28:23 -07:00
..
core.c	nfc: st-nci: remove unused header includes	2021-08-26 09:13:36 +01:00
i2c.c	nfc: st-nci: Convert to i2c's .probe_new()	2022-11-23 12:50:08 -08:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile
ndlc.c	nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition	2023-03-15 00:28:23 -07:00
ndlc.h	nfc: constify nfc_phy_ops	2021-07-25 09:21:21 +01:00
se.c	nfc: fix memory leak of se_io context in nfc_genl_se_io	2023-02-26 14:55:13 +00:00
spi.c	spi: make remove callback a void function	2022-02-09 13:00:45 +00:00
st-nci.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 399	2019-06-05 17:37:12 +02:00
vendor_cmds.c	nfc: use *_set_vendor_cmds() helpers	2022-01-27 13:53:26 +00:00