In the Linux kernel, the following vulnerability has been resolved:
ASoC: rt5645: Fix errorenous cleanup order
There is a logic error when removing rt5645 device as the function rt5645i2cremove() first cancel the &rt5645->jackdetectwork and delete the &rt5645->btnchecktimer latter. However, since the timer handler rt5645btncheckcallback() will re-queue the jackdetect_work, this cleanup order is buggy.
That is, once the deltimersync in rt5645i2cremove is concurrently run with the rt5645btncheckcallback, the canceled jackdetect_work will be rescheduled again, leading to possible use-after-free.
This patch fix the issue by placing the deltimersync function before the canceldelayedwork_sync.
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"314912957237835491086034877028711253667",
"228989190716421217615266498701318160267",
"219239485468551647948095087856440129927",
"320716168482682492967752849073449263971",
"40616711771614894243303300673945429469",
"313486670481177246096902761695285963544"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a5a3dfd9f172dcb115072f0aea5e27d3083c20e",
"target": {
"file": "sound/soc/codecs/rt5645.c"
},
"id": "CVE-2022-49493-29399fd2"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 323.0,
"function_hash": "35215054360142048528670298982364217611"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a5a3dfd9f172dcb115072f0aea5e27d3083c20e",
"target": {
"file": "sound/soc/codecs/rt5645.c",
"function": "rt5645_i2c_remove"
},
"id": "CVE-2022-49493-d516d002"
}
]