tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UPSTREAM: PCI/pwrctrl: Cancel outstanding rescan work when unregistering

Browse Source 
It's possible to trigger use-after-free here by:

  (a) forcing rescan_work_func() to take a long time and
  (b) utilizing a pwrctrl driver that may be unloaded for some reason

Cancel outstanding work to ensure it is finished before we allow our data
structures to be cleaned up.

[bhelgaas: tidy commit log]
Bug: 415347036
Fixes: 8f62819aaa ("PCI/pwrctl: Rescan bus on a separate thread")
Change-Id: Ia319526ed4ef06bec3180378c9a008340cec9658
Signed-off-by: Brian Norris <briannorris@google.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Cc: Konrad Dybcio <konradybcio@kernel.org>
Link: https://patch.msgid.link/20250409115313.1.Ia319526ed4ef06bec3180378c9a008340cec9658@changeid
(cherry picked from commit 8b926f237743f020518162c62b93cb7107a2b5eb)
This commit is contained in:
Brian Norris
2025-04-09 11:53:13 -07:00
committed by Treehugger Robot
parent 174f671de0
commit 4a5a2ac2af
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/pci/pwrctrl/core.c
View File

@@ -101,6 +101,8 @@ EXPORT_SYMBOL_GPL(pci_pwrctrl_device_set_ready);
*/
void pci_pwrctrl_device_unset_ready(struct pci_pwrctrl *pwrctrl)
{
cancel_work_sync(&pwrctrl->work);
/*
* We don't have to delete the link here. Typically, this function
* is only called when the power control device is being detached. If