Description
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irq_work after free_irq The threaded IRQ handler queues data->work through irq_work_queue() so the trigger is polled from a per-CPU context. free_irq() does not flush an irq_work the handler already queued, so after gp2ap020a00f_remove() returns that work may still run and call iio_trigger_poll() on data->trig, which the devm cleanup has already freed, causing a use-after-free. Add irq_work_sync(&data->work) after free_irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 ("iio: trigger: sysfs: fix use-after-free on remove"). Found by an in-house static analysis tool, confirmed by manual review.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
bf29fbeaa13d3350ca71df70c705d8b883c45692 to < 6f2bb000493c3b4f5715b3103657393672aea05baffectedbf29fbeaa13d3350ca71df70c705d8b883c45692 to < 43fbbb9eaae5d6f45668e3c4d45508c498d6ba9caffectedbf29fbeaa13d3350ca71df70c705d8b883c45692 to < d029639b079b28a5334f934c848d895bef0653d1affectedbf29fbeaa13d3350ca71df70c705d8b883c45692 to < 85c20d1cf3f01a506605a16c2f9ce23b9c8b114faffectedbf29fbeaa13d3350ca71df70c705d8b883c45692 to < a36814b9fe00970116d30c3143d81e7425c4d334affectedbf29fbeaa13d3350ca71df70c705d8b883c45692 to < cc71400bc965c0d3894a38ead3d71243400c2d5eaffectedbf29fbeaa13d3350ca71df70c705d8b883c45692 to < a1769877ff52a4f1bfb9ca535d1b5113808bd602affectedbf29fbeaa13d3350ca71df70c705d8b883c45692 to < 63213927b141085b6c8719b8037dab3074b7e0feaffected
Linux Linux
Default version status: affected
3.13affected0 to < 3.13unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6f2bb000493c3b4f5715b3103657393672aea05b ↗
- https://git.kernel.org/stable/c/43fbbb9eaae5d6f45668e3c4d45508c498d6ba9c ↗
- https://git.kernel.org/stable/c/d029639b079b28a5334f934c848d895bef0653d1 ↗
- https://git.kernel.org/stable/c/85c20d1cf3f01a506605a16c2f9ce23b9c8b114f ↗
- https://git.kernel.org/stable/c/a36814b9fe00970116d30c3143d81e7425c4d334 ↗
- https://git.kernel.org/stable/c/cc71400bc965c0d3894a38ead3d71243400c2d5e ↗
- https://git.kernel.org/stable/c/a1769877ff52a4f1bfb9ca535d1b5113808bd602 ↗
- https://git.kernel.org/stable/c/63213927b141085b6c8719b8037dab3074b7e0fe ↗