From: Hyunjung Ko <redacted>
ipc_imem holds five hrtimers. ipc_imem_cleanup() cancels four of them
(td_alloc_timer, tdupdate_timer, fast_update_timer and startup_timer)
but not adb_timer. adb_timer is armed at runtime from the MUX uplink
aggregation path (ipc_imem_adb_timer_start(), reached from the encode
path) whenever aggregation is active.
If the device is torn down (modem reset, PCIe unbind) while an
aggregation window is open, adb_timer can still be queued when
ipc_imem_cleanup() returns and ipc_imem is freed. When it then expires,
ipc_imem_adb_timer_cb() runs container_of() on the freed ipc_imem and
queues a task against it, a use-after-free.
Cancel adb_timer alongside the other hrtimers in ipc_imem_cleanup().
Found by static analysis; not tested on real hardware (needs an Intel
M.2 7360 WWAN modem).
Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
Cc: <redacted>
Signed-off-by: Hyunjung Ko <redacted>
---
drivers/net/wwan/iosm/iosm_ipc_imem.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wwan/iosm/iosm_ipc_imem.c b/drivers/net/wwan/iosm/iosm_ipc_imem.c
index 4405c85..20f8da5 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_imem.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_imem.c
@@ -1239,6 +1239,7 @@ void ipc_imem_cleanup(struct iosm_imem *ipc_imem)
hrtimer_cancel(&ipc_imem->tdupdate_timer);
hrtimer_cancel(&ipc_imem->fast_update_timer);
hrtimer_cancel(&ipc_imem->startup_timer);
+ hrtimer_cancel(&ipc_imem->adb_timer);
/* cancel the workqueue */
cancel_work_sync(&ipc_imem->run_state_worker);
--
2.43.0