[PATCH] mfd: ls2kbmc: cancel the reset work before the driver data is freed

[hyunjungg <hj351016@gmail.com>]

From: Hyunjung Ko <hj351016@gmail.com>

ls2k_bmc_init() INIT_WORK()s ddata->bmc_reset_work (ls2k_bmc_events_fn)
and requests two device-managed interrupts (ls2k_bmc_interrupt) that
schedule_work(&ddata->bmc_reset_work).  The work handler dereferences
ddata via container_of().

ddata is devm_kzalloc()'d, so devres frees it when the device is
unbound.  Nothing cancels bmc_reset_work: free_irq() (run by devres)
only waits for the interrupt handler to finish, not for a work item it
has already queued.  If a BMC reset interrupt fires shortly before
unbind, the queued ls2k_bmc_events_fn() can run after ddata has been
freed -> use-after-free.

Register the work for device-managed cancellation with
devm_work_autocancel(), before the devm_request_irq() calls that arm
it, so devres (LIFO) frees the interrupts first, then cancels the work,
and only then frees ddata.

Found by code review; not reproduced (needs Loongson-2K BMC hardware and
a reset interrupt racing driver unbind).

Fixes: d952bba3fbb5 ("mfd: ls2kbmc: Add Loongson-2K BMC reset function support")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/mfd/ls2k-bmc-core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
index 408056b..c44291e 100644
--- a/drivers/mfd/ls2k-bmc-core.c
+++ b/drivers/mfd/ls2k-bmc-core.c
@@ -12,6 +12,7 @@
 #include <linux/aperture.h>
 #include <linux/bitfield.h>
 #include <linux/delay.h>
+#include <linux/devm-helpers.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/iopoll.h>
@@ -371,7 +372,10 @@ static int ls2k_bmc_init(struct ls2k_bmc_ddata *ddata)
 
 	ls2k_bmc_save_pci_data(pdev, ddata);
 
-	INIT_WORK(&ddata->bmc_reset_work, ls2k_bmc_events_fn);
+	ret = devm_work_autocancel(ddata->dev, &ddata->bmc_reset_work,
+				   ls2k_bmc_events_fn);
+	if (ret)
+		return ret;
 
 	ret = devm_request_irq(&pdev->dev, pdev->irq, ls2k_bmc_interrupt,
 			       IRQF_SHARED | IRQF_TRIGGER_FALLING, "ls2kbmc pcie", ddata);
-- 
2.43.0