power: supply: generic-adc-battery: fix possible use-after-free in gab_remove()
authorYang Yingliang <yangyingliang@huawei.com>
Wed, 7 Apr 2021 09:17:06 +0000 (17:17 +0800)
committerSebastian Reichel <sebastian.reichel@collabora.com>
Thu, 8 Apr 2021 12:35:19 +0000 (14:35 +0200)
commitb6cfa007b3b229771d9588970adb4ab3e0487f49
tree6af1e72841a385615e285b81812c388cfc8c839c
parente61ffb344591fca443be4fc633290cbf15ee3298
power: supply: generic-adc-battery: fix possible use-after-free in gab_remove()

This driver's remove path calls cancel_delayed_work(). However, that
function does not wait until the work function finishes. This means
that the callback function may still be running after the driver's
remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that
the work is properly cancelled, no longer running, and unable
to re-schedule itself.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
drivers/power/supply/generic-adc-battery.c