Reka Norman 8c1d378b8c HID: intel-ish-hid: ipc: Fix potential use-after-free in work function ... [ Upstream commit 8ae2f2b0a2 ] When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer ishtp_dev. If ish_probe() fails, the devm-managed device resources including ishtp_dev are freed, but the work is not cancelled, causing a use-after-free when the work function tries to access ishtp_dev. Use devm_work_autocancel() instead, so that the work is automatically cancelled if probe fails. Signed-off-by: Reka Norman <rekanorman@chromium.org> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-03-30 12:47:53 +02:00
..
ipc	HID: intel-ish-hid: ipc: Fix potential use-after-free in work function	2023-03-30 12:47:53 +02:00
ishtp	HID: intel_ish-hid: Add check for ishtp_dma_tx_map	2023-02-01 08:27:04 +01:00
Kconfig	HID: intel-ish-hid: Set ISH driver depends on x86	2021-06-14 15:55:09 +02:00
Makefile	treewide: prefix header search paths with $(srctree)/	2019-05-18 11:49:57 +09:00
ishtp-fw-loader.c	HID: intel-ish-hid: Use dma_alloc_coherent for firmware update	2022-04-08 14:22:51 +02:00
ishtp-hid-client.c	HID: intel-ish-hid: use async resume function	2021-07-15 20:49:09 +02:00
ishtp-hid.c	HID: intel-ish-hid: Fix potential copy/paste error	2021-04-07 17:56:34 +02:00
ishtp-hid.h	HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo	2022-09-20 12:39:44 +02:00