[PATCH 03/28] mfd: ls2kbmc: Cancel reset work on teardown via devm_work_autocancel()

[Lee Jones]

ls2k_bmc_init() initialises bmc_reset_work with INIT_WORK() and
immediately requests the PCIe and GPIO interrupts via devm_request_irq().
If an interrupt fires and schedules bmc_reset_work before a subsequent
step in ls2k_bmc_probe() fails, or when the device is unbound, devres
frees ddata whilst bmc_reset_work remains queued, leading to a
use-after-free in ls2k_bmc_events_fn().

Initialise bmc_reset_work with devm_work_autocancel() before requesting
the interrupts so that devres cancels any pending work after the
interrupts are freed and before ddata is released.

Fixes: d952bba3fbb5 ("mfd: ls2kbmc: Add Loongson-2K BMC reset function support")
Closes: https://sashiko.dev/#/bug/linux-3089d131-9fcf-4753-b183-eebe0a6e020e
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
 drivers/mfd/ls2k-bmc-core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
index 23c774a09842..e245bdee8226 100644
--- a/drivers/mfd/ls2k-bmc-core.c
+++ b/drivers/mfd/ls2k-bmc-core.c
@@ -12,6 +12,7 @@
 #include <linux/aperture.h>
 #include <linux/bitfield.h>
 #include <linux/delay.h>
+#include <linux/devm-helpers.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/iopoll.h>
@@ -376,7 +377,9 @@ static int ls2k_bmc_init(struct ls2k_bmc_ddata *ddata)
 
 	ls2k_bmc_save_pci_data(pdev, ddata);
 
-	INIT_WORK(&ddata->bmc_reset_work, ls2k_bmc_events_fn);
+	ret = devm_work_autocancel(ddata->dev, &ddata->bmc_reset_work, ls2k_bmc_events_fn);
+	if (ret)
+		return ret;
 
 	ret = devm_request_irq(&pdev->dev, pdev->irq, ls2k_bmc_interrupt,
 			       IRQF_SHARED | IRQF_TRIGGER_FALLING, "ls2kbmc pcie", ddata);
-- 
2.56.0.218.g1ec904b173-goog