From: Hyunjung Ko ipc_imem holds five hrtimers. ipc_imem_cleanup() cancels four of them (td_alloc_timer, tdupdate_timer, fast_update_timer and startup_timer) but not adb_timer. adb_timer is armed at runtime from the MUX uplink aggregation path (ipc_imem_adb_timer_start(), reached from the encode path) whenever aggregation is active. If the device is torn down (modem reset, PCIe unbind) while an aggregation window is open, adb_timer can still be queued when ipc_imem_cleanup() returns and ipc_imem is freed. When it then expires, ipc_imem_adb_timer_cb() runs container_of() on the freed ipc_imem and queues a task against it, a use-after-free. Cancel adb_timer alongside the other hrtimers in ipc_imem_cleanup(). Found by static analysis; not tested on real hardware (needs an Intel M.2 7360 WWAN modem). Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support") Cc: stable@vger.kernel.org Signed-off-by: Hyunjung Ko --- drivers/net/wwan/iosm/iosm_ipc_imem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wwan/iosm/iosm_ipc_imem.c b/drivers/net/wwan/iosm/iosm_ipc_imem.c index 4405c85..20f8da5 100644 --- a/drivers/net/wwan/iosm/iosm_ipc_imem.c +++ b/drivers/net/wwan/iosm/iosm_ipc_imem.c @@ -1239,6 +1239,7 @@ void ipc_imem_cleanup(struct iosm_imem *ipc_imem) hrtimer_cancel(&ipc_imem->tdupdate_timer); hrtimer_cancel(&ipc_imem->fast_update_timer); hrtimer_cancel(&ipc_imem->startup_timer); + hrtimer_cancel(&ipc_imem->adb_timer); /* cancel the workqueue */ cancel_work_sync(&ipc_imem->run_state_worker); -- 2.43.0