[PATCH] Input: lm8323 - cancel PWM works on unbind to avoid use-after-free

[PATCH] Input: lm8323 - cancel PWM works on unbind to avoid use-after-free

[hyunjungg]

From: Hyunjung Ko <hj351016@gmail.com>

lm8323 registers LM8323_NUM_PWMS PWM works (lm8323_pwm_work) and
schedules them from the threaded IRQ handler, when a PWM ramp script
completes, and from the LED brightness_set callback. The handler
dereferences the containing struct lm8323_pwm and its ->chip, i.e. the
struct lm8323_chip.

The driver is fully device-managed and has no remove callback, and
nothing ever cancels these works. struct lm8323_chip is allocated with
devm_kzalloc(), so on unbind devres frees it once probe's resources are
released. A PWM ramp completion interrupt arriving while a fade is in
progress schedules pwm->work; free_irq() stops further interrupts but
does not cancel an already queued work, and led_classdev_unregister()
only flushes the LED core's own work, not this driver-private one. The
queued work can therefore run after the lm8323_chip has been freed,
dereferencing freed memory (use-after-free).

Register the works with devm_work_autocancel() instead of INIT_WORK().
It is registered in init_pwm(), before devm_request_threaded_irq(), so
on unwind devres runs free_irq() first, after which no new work can be
scheduled, and then cancels each work while the lm8323_chip is still
valid. The handler does not re-queue itself, the re-arming comes from
the interrupt, so a single cancel drains it.

Found by static analysis and code review; not runtime-reproduced (needs
LM8323 keypad/PWM hardware with a fade in progress racing device unbind).

Fixes: a48b2d4a0091 ("Input: introduce lm8323 keypad driver")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/input/keyboard/lm8323.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/input/keyboard/lm8323.c b/drivers/input/keyboard/lm8323.c
index 8eac63b..388b790 100644
--- a/drivers/input/keyboard/lm8323.c
+++ b/drivers/input/keyboard/lm8323.c
@@ -16,6 +16,7 @@
 #include <linux/sched.h>
 #include <linux/mutex.h>
 #include <linux/delay.h>
+#include <linux/devm-helpers.h>
 #include <linux/input.h>
 #include <linux/leds.h>
 #include <linux/platform_data/lm8323.h>
@@ -564,7 +565,9 @@ static int init_pwm(struct lm8323_chip *lm, int id, struct device *dev,
 	pwm->desired_brightness = 0;
 	pwm->running = false;
 	pwm->enabled = false;
-	INIT_WORK(&pwm->work, lm8323_pwm_work);
+	err = devm_work_autocancel(dev, &pwm->work, lm8323_pwm_work);
+	if (err)
+		return err;
 	mutex_init(&pwm->lock);
 	pwm->chip = lm;
 
-- 
2.43.0