[PATCH] nfc: st-nci: use timer_shutdown_sync in ndlc_remove

[PATCH] nfc: st-nci: use timer_shutdown_sync in ndlc_remove

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

ndlc_remove() uses timer_delete_sync() to stop t1_timer and t2_timer
before cancel_work_sync(). However, the timer callbacks
ndlc_t1_timeout() and ndlc_t2_timeout() schedule sm_work, and
llt_ndlc_sm_work() re-arms the timers via mod_timer(). This creates a
circular rearm: after timer_delete_sync() returns, sm_work can still
re-arm the timer, which fires again after cancel_work_sync() completes.

Use timer_shutdown_sync() instead, which prevents the timers from being
re-armed by mod_timer() calls in the work function, breaking the
circular dependency.

Fixes: 5000fe6c27827 ("nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/nfc/st-nci/ndlc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nfc/st-nci/ndlc.c b/drivers/nfc/st-nci/ndlc.c
index be4808859cfa9..14e1213d76c9b 100644
--- a/drivers/nfc/st-nci/ndlc.c
+++ b/drivers/nfc/st-nci/ndlc.c
@@ -283,8 +283,8 @@ EXPORT_SYMBOL(ndlc_probe);
 void ndlc_remove(struct llt_ndlc *ndlc)
 {
 	/* cancel timers */
-	timer_delete_sync(&ndlc->t1_timer);
-	timer_delete_sync(&ndlc->t2_timer);
+	timer_shutdown_sync(&ndlc->t1_timer);
+	timer_shutdown_sync(&ndlc->t2_timer);
 	ndlc->t2_active = false;
 	ndlc->t1_active = false;
 	/* cancel work */
-- 
2.47.3