From: Zheng Wang <zyytlz.wz@163.com>

Date: Fri, 10 Mar 2023 16:40:07 +0800

Subject: hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to

 race condition

Git-commit: cb090e64cf25602b9adaf32d5dfc9c8bec493cd1

Patch-mainline: v6.3-rc3

References: CVE-2023-1855 bsc#1210202

In xgene_hwmon_probe, &ctx->workq is bound with xgene_hwmon_evt_work.

Then it will be started.

If we remove the driver which will call xgene_hwmon_remove to clean up,

there may be unfinished work.

The possible sequence is as follows:

Fix it by finishing the work before cleanup in xgene_hwmon_remove.

CPU0                  CPU1

                    |xgene_hwmon_evt_work

xgene_hwmon_remove   |

kfifo_free(&ctx->async_msg_fifo);|

                    |

                    |kfifo_out_spinlocked

                    |//use &ctx->async_msg_fifo

Fixes: 2ca492e22cb7 ("hwmon: (xgene) Fix crash when alarm occurs before driver probe")

Signed-off-by: Zheng Wang <zyytlz.wz@163.com>

Link: https://lore.kernel.org/r/20230310084007.1403388-1-zyytlz.wz@163.com

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Acked-by: Roy Hopkins <roy.hopkins@suse.com>

---

 drivers/hwmon/xgene-hwmon.c | 1 +

 1 file changed, 1 insertion(+)

diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c

index 5cde837bfd09..d1abea49f01b 100644

--- a/drivers/hwmon/xgene-hwmon.c

+++ b/drivers/hwmon/xgene-hwmon.c

@@ -761,6 +761,7 @@ static int xgene_hwmon_remove(struct platform_device *pdev)

 {

 	struct xgene_hwmon_dev *ctx = platform_get_drvdata(pdev);

+	cancel_work_sync(&ctx->workq);

 	hwmon_device_unregister(ctx->hwmon_dev);

 	kfifo_free(&ctx->async_msg_fifo);

 	if (acpi_disabled)