Re: [PATCH] hwrng: cctrng: Fix use-after-free in cctrng_remove due to race condition

[Herbert Xu]

On Tue, Aug 04, 2026 at 03:34:41PM +0800, Pei Xiao wrote:
>
> diff --git a/drivers/char/hw_random/cctrng.c b/drivers/char/hw_random/cctrng.c
> index a6925211c3b5..dd41f2d1fee5 100644
> --- a/drivers/char/hw_random/cctrng.c
> +++ b/drivers/char/hw_random/cctrng.c
> @@ -568,6 +568,12 @@ static void cctrng_remove(struct platform_device *pdev)
>  
>  	cc_trng_pm_fini(drvdata);
>  
> +	/* Mask RNG interrupts so cc_isr cannot schedule new work */
> +	cc_iowrite(drvdata, CC_RNG_IMR_REG_OFFSET, 0xFFFFFFFF);
> +
> +	cancel_work_sync(&drvdata->compwork);
> +	cancel_work_sync(&drvdata->startwork);

I don't think this closes the race window.  After all, the ISR could
have already been started before your iowrite call.

Is there any way to make devm make the cancel_work_sync calls after
the ISR has been deregistered?

Thanks,
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt