Re: [PATCH] hwrng: cctrng: Fix use-after-free in cctrng_remove due to race condition

[Pei Xiao]

在 2026/8/15 08:57, Herbert Xu 写道:
> On Tue, Aug 04, 2026 at 03:34:41PM +0800, Pei Xiao wrote:
>>
>> diff --git a/drivers/char/hw_random/cctrng.c b/drivers/char/hw_random/cctrng.c
>> index a6925211c3b5..dd41f2d1fee5 100644
>> --- a/drivers/char/hw_random/cctrng.c
>> +++ b/drivers/char/hw_random/cctrng.c
>> @@ -568,6 +568,12 @@ static void cctrng_remove(struct platform_device *pdev)
>>  
>>  	cc_trng_pm_fini(drvdata);
>>  
>> +	/* Mask RNG interrupts so cc_isr cannot schedule new work */
>> +	cc_iowrite(drvdata, CC_RNG_IMR_REG_OFFSET, 0xFFFFFFFF);
>> +
>> +	cancel_work_sync(&drvdata->compwork);
>> +	cancel_work_sync(&drvdata->startwork);
> 
> I don't think this closes the race window.  After all, the ISR could
> have already been started before your iowrite call.
> 
> Is there any way to make devm make the cancel_work_sync calls after
> the ISR has been deregistered?
Hi Maintainer,
  Thanks your reply.
  How about this:
diff --git a/drivers/char/hw_random/cctrng.c
b/drivers/char/hw_random/cctrng.c
index a6925211c3b5..c1536660e8d5 100644
--- a/drivers/char/hw_random/cctrng.c
+++ b/drivers/char/hw_random/cctrng.c
@@ -11,6 +11,7 @@
 #include <linux/interrupt.h>
 #include <linux/irqreturn.h>
 #include <linux/workqueue.h>
+#include <linux/devm-helpers.h>
 #include <linux/circ_buf.h>
 #include <linux/completion.h>
 #include <linux/of.h>
@@ -502,8 +503,16 @@ static int cctrng_probe(struct platform_device *pdev)
                return dev_err_probe(dev, PTR_ERR(drvdata->clk),
                                     "Failed to get or enable the clock\n");

-       INIT_WORK(&drvdata->compwork, cc_trng_compwork_handler);
-       INIT_WORK(&drvdata->startwork, cc_trng_startwork_handler);
+       rc = devm_work_autocancel(dev, &drvdata->compwork,
+                                 cc_trng_compwork_handler);
+       if (rc)
+               return rc;
+
+       rc = devm_work_autocancel(dev, &drvdata->startwork,
+                                 cc_trng_startwork_handler);
+       if (rc)
+               return rc;
+
        spin_lock_init(&drvdata->read_lock);

        /* register the driver isr function */

Thanks!

> 
> Thanks,