HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
authorReka Norman <rekanorman@chromium.org>
Mon, 27 Feb 2023 02:49:38 +0000 (13:49 +1100)
committerJiri Kosina <jkosina@suse.cz>
Fri, 3 Mar 2023 14:06:11 +0000 (15:06 +0100)
commit8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785
treef3397f7ce08e9f227b65be0b84604ac98f8ce3ca
parentdb50f7a3983f0154e730f1147ef729e0c5c2f90c
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function

When a reset notify IPC message is received, the ISR schedules a work
function and passes the ISHTP device to it via a global pointer
ishtp_dev. If ish_probe() fails, the devm-managed device resources
including ishtp_dev are freed, but the work is not cancelled, causing a
use-after-free when the work function tries to access ishtp_dev. Use
devm_work_autocancel() instead, so that the work is automatically
cancelled if probe fails.

Signed-off-by: Reka Norman <rekanorman@chromium.org>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/intel-ish-hid/ipc/ipc.c