[PATCH] staging: vme_user: fake: stop tasklet before freeing its data

[Yunshui Jiang]

From: jiangyunshui <jiangyunshui@xxxxxxxxxx>

fake_init() arms a tasklet whose callback fake_VIRQ_tasklet()
dereferences fake_bridge and fake_bridge->driver_priv. Both fake_exit()
and the err_master error path of fake_init() free
fake_bridge->driver_priv (which embeds int_tasklet) and fake_bridge
without calling tasklet_kill(), so a pending or running tasklet may
access already-freed memory (use-after-free).

Add tasklet_kill() before the frees in both paths.

Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Signed-off-by: jiangyunshui <jiangyunshui@xxxxxxxxxx>
---
 drivers/staging/vme_user/vme_fake.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vme_user/vme_fake.c b/drivers/staging/vme_user/vme_fake.c
index 434cf760ade6..7b9d13183a41 100644
--- a/drivers/staging/vme_user/vme_fake.c
+++ b/drivers/staging/vme_user/vme_fake.c
@@ -1226,6 +1226,7 @@ static int __init fake_init(void)
 		kfree(master_image);
 	}

+	tasklet_kill(&fake_device->int_tasklet);
 	kfree(fake_device);
 err_driver:
 	kfree(fake_bridge);
@@ -1291,6 +1292,8 @@ static void __exit fake_exit(void)
 		kfree(master_image);
 	}

+	tasklet_kill(&bridge->int_tasklet);
+
 	kfree(fake_bridge->driver_priv);

 	kfree(fake_bridge);
--
2.34.1