platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver

Tzung-Bi Shih · Tzung-Bi Shih · commit 944edca81e7a · 2025-11-10T06:29:54.000Z
After unbinding the driver, another kthread `cros_ec_console_log_work` is still accessing the device, resulting an UAF and crash. The driver doesn't unregister the EC device in .remove() which should shutdown sub-devices synchronously. Fix it. Fixes: 26a1426 ("platform/chrome: Add ChromeOS EC ISHTP driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20251031033900.3577394-1-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c
@@ -667,6 +667,7 @@ static void cros_ec_ishtp_remove(struct ishtp_cl_device *cl_device)
 
 	cancel_work_sync(&client_data->work_ishtp_reset);
 	cancel_work_sync(&client_data->work_ec_evt);
+	cros_ec_unregister(client_data->ec_dev);
 	cros_ish_deinit(cros_ish_cl);
 	ishtp_put_device(cl_device);
 }

Original file line number	Diff line number	Diff line change
`@@ -667,6 +667,7 @@ static void cros_ec_ishtp_remove(struct ishtp_cl_device *cl_device)`
`667`	`667`
`668`	`668`	`cancel_work_sync(&client_data->work_ishtp_reset);`
`669`	`669`	`cancel_work_sync(&client_data->work_ec_evt);`
	`670`	`+ cros_ec_unregister(client_data->ec_dev);`
`670`	`671`	`cros_ish_deinit(cros_ish_cl);`
`671`	`672`	`ishtp_put_device(cl_device);`
`672`	`673`	`}`