[PATCH net] net: wwan: iosm: fix potential use after free in ipc_imem_cleanup()

[Abdun Nihaal]

During cleanup, the ipc_protocol_deinit() is called before the tasklets
are cleaned up. The tasklets may concurrently access the memory
allocated for ipc_protocol and so it could result in a use-after-free.
Fix that by moving ipc_protocol_deinit() after ipc_task_deinit().

Fixes: 3670970dd8c6 ("net: iosm: shared memory IPC interface")
Cc: stable@xxxxxxxxxxxxxxx
Suggested-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Signed-off-by: Abdun Nihaal <nihaal@xxxxxxxxxxxxxx>
---
Compile tested only. Not tested on hardware.

 drivers/net/wwan/iosm/iosm_ipc_imem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wwan/iosm/iosm_ipc_imem.c b/drivers/net/wwan/iosm/iosm_ipc_imem.c
index 4405c8531888..939364daf5c7 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_imem.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_imem.c
@@ -1256,8 +1256,8 @@ void ipc_imem_cleanup(struct iosm_imem *ipc_imem)
 	ipc_imem_device_ipc_uninit(ipc_imem);
 	ipc_imem_channel_reset(ipc_imem);
 
-	ipc_protocol_deinit(ipc_imem->ipc_protocol);
 	ipc_task_deinit(ipc_imem->ipc_task);
+	ipc_protocol_deinit(ipc_imem->ipc_protocol);
 
 	kfree(ipc_imem->ipc_task);
 	kfree(ipc_imem->mmio);
-- 
2.43.0