[PATCH] mISDN: hfcpci: Fix use-after-free bug in hfcpci_Timer

[Duoming Zhou]

If the timer handler hfcpci_Timer() is running, the
del_timer(&hc->hw.timer) in release_io_hfcpci() could
not stop it. As a result, the use-after-free bug will
happen. The process is shown below:

    (cleanup routine)          |        (timer handler)
release_card()                 | hfcpci_Timer()
  release_io_hfcpci            |
    del_timer(&hc->hw.timer)   |
  ...                          |  ...
  kfree(hc) //[1]FREE          |
                               |   hc->hw.timer.expires //[2]USE

The hfc_pci is deallocated in position [1] and used in
position [2].

Fix by changing del_timer() in release_io_hfcpci() to
del_timer_sync(), which makes sure the hfcpci_Timer()
have finished before the hfc_pci is deallocated.

Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver")
Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx>
---
 drivers/isdn/hardware/mISDN/hfcpci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index af17459c1a5..5cf37fe7de2 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -157,7 +157,7 @@ release_io_hfcpci(struct hfc_pci *hc)
 {
 	/* disable memory mapped ports + busmaster */
 	pci_write_config_word(hc->pdev, PCI_COMMAND, 0);
-	del_timer(&hc->hw.timer);
+	del_timer_sync(&hc->hw.timer);
 	dma_free_coherent(&hc->pdev->dev, 0x8000, hc->hw.fifos,
 			  hc->hw.dmahandle);
 	iounmap(hc->hw.pci_io);
-- 
2.17.1