ieee802154/adf7242: defer destroy_workqueue call
authorLin Ma <linma@zju.edu.cn>
Mon, 8 Aug 2022 03:42:24 +0000 (11:42 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Sep 2022 10:28:02 +0000 (12:28 +0200)
commit9f8558c5c642c62c450c98c99b7d18a709fff485
treefa161adcee62b6d6fc0a2cbcc287726b126848c3
parent222bd95c89b135fde21f0bd0cb5cc1611c0c576c
ieee802154/adf7242: defer destroy_workqueue call

[ Upstream commit afe7116f6d3b888778ed6d95e3cf724767b9aedf ]

There is a possible race condition (use-after-free) like below

  (FREE)                     |  (USE)
  adf7242_remove             |  adf7242_channel
   cancel_delayed_work_sync  |
    destroy_workqueue (1)    |   adf7242_cmd_rx
                             |    mod_delayed_work (2)
                             |

The root cause for this race is that the upper layer (ieee802154) is
unaware of this detaching event and the function adf7242_channel can
be called without any checks.

To fix this, we can add a flag write at the beginning of adf7242_remove
and add flag check in adf7242_channel. Or we can just defer the
destructive operation like other commit 3e0588c291d6 ("hamradio: defer
ax25 kfree after unregister_netdev") which let the
ieee802154_unregister_hw() to handle the synchronization. This patch
takes the second option.

Fixes: 58e9683d1475 ("net: ieee802154: adf7242: Fix OCL calibration
runs")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Link: https://lore.kernel.org/r/20220808034224.12642-1-linma@zju.edu.cn
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ieee802154/adf7242.c