[sync] PR-1089: power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition · Pull Request !1104 · openEuler/kernel

### 1. Origin pull request:
https://gitee.com/openeuler/kernel/pulls/1089

### 2. Original pull request related issue(s):

### 3. Original pull request related commit(s):
| Sha | Datetime | Message |
|---|---|---|
|[085b94ff](https://gitee.com/openeuler/kernel/commits/085b94ff230d38a85c69c6e8d1befba9e8075629)|2023-06-12 17:04:03 +0800 CST|power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition stable inclusion from stable-v5.10.177 commit 2b346876b93168541a45551d5f9abd1d26102e89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7781Q CVE: CVE-2023-33288 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2b346876b93168541a45551d5f9abd1d26102e89 -------------------------------- [ Upstream commit 47c29d69212911f50bdcdd0564b5999a559010d4 ] In bq24190_probe, &bdi->input_current_limit_work is bound with bq24190_input_current_limit_work. When external power changed, it will call bq24190_charger_external_power_changed to start the work. If we remove the module which will call bq24190_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: CPU0 CPUc1 |bq24190_input_current_limit_work bq24190_remove | power_supply_unregister | device_unregister | power_supply_dev_release| kfree(psy) | | | power_supply_get_property_from_supplier | //use Fix it by finishing the work before cleanup in the bq24190_remove Fixes: 97774672573a ("power_supply: Initialize changed_work before calling device_add") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: 	drivers/power/supply/bq24190_charger.c Signed-off-by: Zhao Wenhui <zhaowenhui8@huawei.com> |

GVPopenEuler/kernel

搜索帮助

GVP openEuler/kernel