[PATCH] Auxiliary display drivers: fix possible race condition

[Alexander A. Klimov]

Before linedisp_unregister(), call disable_delayed_work_sync(),
not just cancel_delayed_work_sync().

While cancel_delayed_work_sync() cancels queued work and
awaits running work, it doesn't reject future work, such as
scheduled by the timer which is set up in linedisp_register().
This timer may fire just before linedisp_unregister() stops it
and cause kind of use after free.

In contrast, disable_delayed_work_sync() also prevents future work.

Signed-off-by: Alexander A. Klimov <grandmaster@xxxxxxxxxxxx>
---
 drivers/auxdisplay/max6959.c      | 2 +-
 drivers/auxdisplay/seg-led-gpio.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/auxdisplay/max6959.c b/drivers/auxdisplay/max6959.c
index 6bbc8d48fb..a123077945 100644
--- a/drivers/auxdisplay/max6959.c
+++ b/drivers/auxdisplay/max6959.c
@@ -148,7 +148,7 @@ static void max6959_i2c_remove(struct i2c_client *client)
 {
 	struct max6959_priv *priv = i2c_get_clientdata(client);

-	cancel_delayed_work_sync(&priv->work);
+	disable_delayed_work_sync(&priv->work);
 	linedisp_unregister(&priv->linedisp);
 }

diff --git a/drivers/auxdisplay/seg-led-gpio.c b/drivers/auxdisplay/seg-led-gpio.c
index dfb62e9ce9..83a2b3ff13 100644
--- a/drivers/auxdisplay/seg-led-gpio.c
+++ b/drivers/auxdisplay/seg-led-gpio.c
@@ -84,7 +84,7 @@ static void seg_led_remove(struct platform_device *pdev)
 {
 	struct seg_led_priv *priv = platform_get_drvdata(pdev);

-	cancel_delayed_work_sync(&priv->work);
+	disable_delayed_work_sync(&priv->work);
 	linedisp_unregister(&priv->linedisp);
 }

--
2.54.0