[PATCH v1] net: plip: cancel pending work before freeing device

[Sicong Huang]

plip_close() stops the IRQ and the poll timer but does not cancel
the immediate and deferred work items before returning. These two
work items are initialised in plip_init_netdev() via
INIT_WORK(&nl->immediate, plip_bh) and
INIT_DELAYED_WORK(&nl->deferred, plip_kick_bh).
plip_cleanup_module() calls free_netdev() which frees the
net_local structure while those work items may still be queued or
running in the workqueue, resulting in a use-after-free.

Fix this by calling cancel_delayed_work_sync() and cancel_work_sync()
after all sources of new work scheduling have been shut down (IRQ
disabled, poll timer stopped) but before releasing parport and
freeing any skbs.

Signed-off-by: Sicong Huang <congei42@xxxxxxx>
---
 drivers/net/plip/plip.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/plip/plip.c b/drivers/net/plip/plip.c
index d81163bc910a..4f0ab14f2024 100644
--- a/drivers/net/plip/plip.c
+++ b/drivers/net/plip/plip.c
@@ -1141,6 +1141,9 @@ plip_close(struct net_device *dev)
 		wait_for_completion(&nl->killed_timer_cmp);
 	}
 
+	cancel_delayed_work_sync(&nl->deferred);
+	cancel_work_sync(&nl->immediate);
+
 #ifdef NOTDEF
 	outb(0x00, PAR_DATA(dev));
 #endif
-- 
2.34.1