Hi Sven, On Thu, Feb 7, 2019 at 1:49 PM Sven Van Asbroeck <thesve...@gmail.com> wrote: > > On Tue, Feb 5, 2019 at 9:57 AM Kees Cook <keesc...@chromium.org> wrote: > > > > Can a Coccinelle script get written to find module-use of the non-devm > > work init? > > Ok so I hacked together a Coccinelle script to find these > user-after-free issues, > related to work left running when the device or module is removed. > > As far as I can see, these issues may crash/corrupt the kernel even on > _device_ remove/unplug. Users don't need root for that... > > I got 71 hits. At least one is a false positive. > 34 out of 71 could benefit from devm_init_work(). ... > ./drivers//input/serio/ps2-gpio.c:412:1-18: missing clean-up of > INIT_WORK/INIT_DELAYED_WORK initialized here (maybe use devm_)
OK, this seems to be a real issue. We need to make sure we flush the TX work inside ps2_gpio_close(). > ./drivers//input/keyboard/matrix_keypad.c:512:1-18: missing clean-up > of INIT_WORK/INIT_DELAYED_WORK initialized here This is not as simple. The work in question is scheduled from matrix_keypad_start() and matrix_keypad_stop() uses flush_work() to make sure currently running instance completes after making sure that it will not be rescheduled. And matrix_keypad_stop() is guaranteed to be called by input core when input device is being unregistered if input device was opened. So in effect we do not actually leak work past driver remove(). Thanks. -- Dmitry
