AZL-97700

In the Linux kernel, the following vulnerability has been resolved:

mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

In atmciprobe, &host->bhwork is bound with atmciworkfunc, and atmciinterrupt, atmcitimeouttimer and atmcidmacomplete can all queue this work on systembh_wq.

If we remove the module, atmciremove makes cleanup and the memory allocated for host with devmkzalloc() is released after the remove callback returns, while the work mentioned above may still be pending or running. The sequence of operations that may lead to a UAF bug is as follows:

CPU0 CPU1

                                      | atmci_interrupt
                                      | queue_work(system_bh_wq,
                                      |            &host->bh_work)

atmciremove | atmcicleanupslot(...) | atmciwritel(host, ATMCIIDR, ~0UL) | timerdeletesync(&host->timer) | dmareleasechannel(host->dma.chan) | freeirq(platformgetirq(pdev, 0), host) | | atmciworkfunc | // use host // devm resources released after | // remove returns, host is freed | | // use host (use-after-free)

Fix it by canceling the work after all the sources that can schedule it (IRQ handler, timeout timer and DMA completion callback) have been stopped, and before proceeding with the remaining cleanup in atmci_remove.