Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Duoming Zhou <duoming@zju.edu.cn>
To:     linux-kernel@vger.kernel.org
Cc:     netdev@vger.kernel.org, isdn@linux-pingi.de, kuba@kernel.org,
        gregkh@linuxfoundation.org, andrii@kernel.org, davem@davemloft.net,
        axboe@kernel.dk, Duoming Zhou <duoming@zju.edu.cn>
Subject: [PATCH] mISDN: hfcpci: Fix use-after-free bug in hfcpci_Timer
Date:   Thu, 13 Oct 2022 20:57:29 +0800
Message-Id: <20221013125729.105652-1-duoming@zju.edu.cn>
Precedence: bulk

If the timer handler hfcpci_Timer() is running, the
del_timer(&hc->hw.timer) in release_io_hfcpci() could
not stop it. As a result, the use-after-free bug will
happen. The process is shown below:

    (cleanup routine)          |        (timer handler)
release_card()                 | hfcpci_Timer()
  release_io_hfcpci            |
    del_timer(&hc->hw.timer)   |
  ...                          |  ...
  kfree(hc) //[1]FREE          |
                               |   hc->hw.timer.expires //[2]USE

The hfc_pci is deallocated in position [1] and used in
position [2].

Fix by changing del_timer() in release_io_hfcpci() to
del_timer_sync(), which makes sure the hfcpci_Timer()
have finished before the hfc_pci is deallocated.

Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
---
 drivers/isdn/hardware/mISDN/hfcpci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index af17459c1a5..5cf37fe7de2 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -157,7 +157,7 @@ release_io_hfcpci(struct hfc_pci *hc)
 {
 	/* disable memory mapped ports + busmaster */
 	pci_write_config_word(hc->pdev, PCI_COMMAND, 0);
-	del_timer(&hc->hw.timer);
+	del_timer_sync(&hc->hw.timer);
 	dma_free_coherent(&hc->pdev->dev, 0x8000, hc->hw.fifos,
 			  hc->hw.dmahandle);
 	iounmap(hc->hw.pci_io);
-- 
2.17.1