[PATCH] intel_th: msu: drain the window-switch work on removal

[Hyunjung Ko <hj351016@gmail.com>]

msc->work (msc_work) is scheduled from intel_th_msc_interrupt() when the
next window is locked and the trace has to be stopped from process
context; the handler dereferences msc and calls intel_th_msc_deactivate().

msc is allocated with devm_kzalloc(), so devres frees it after
intel_th_msc_remove() returns. remove() deactivates the trace (so no new
work is queued) but never drains a msc->work that the interrupt has
already queued. That pending work can then run after msc has been freed
and dereference freed memory (msc->buf_mutex) -- a use-after-free.

Cancel the work in intel_th_msc_remove(), after the trace is deactivated
so it cannot be re-queued, before the device is torn down.

Found by static analysis; not runtime-reproduced (needs an Intel Trace Hub
with the MSU in stop-on-full mode and a window-full interrupt racing
removal).

Fixes: 615c164da0eb ("intel_th: msu: Introduce buffer interface")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/hwtracing/intel_th/msu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index 84d99d7..902e7d2 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -2174,6 +2174,14 @@ static void intel_th_msc_remove(struct intel_th_device *thdev)
 	intel_th_msc_deactivate(thdev);

 	/*
+	 * msc->work (msc_work) is scheduled from the window-switch interrupt
+	 * when stop_on_full is set and dereferences msc; deactivate has stopped
+	 * the trace so no new work is queued, drain a pending one before the
+	 * devm-allocated msc is freed.
+	 */
+	cancel_work_sync(&msc->work);
+
+	/*
 	 * Buffers should not be used at this point except if the
 	 * output character device is still open and the parent
 	 * device gets detached from its bus, which is a FIXME.
--
2.43.0