In the Linux kernel, the following vulnerability has been resolved:
media: netupunidvb: fix use-after-free at deltimer()
When Universal DVB card is detaching, netupunidvbdmafini() uses deltimer() to stop dma->timeout timer. But when timer handler netupunidvbdmatimeout() is running, deltimer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below:
(cleanup routine) | (timer routine)
| mod_timer(&dev->tx_sim_timer, ..)
netupunidvbfinidev() | (wait a time) netupunidvbdmafini() | netupunidvbdmatimeout() deltimer(&dma->timeout); | | ndev->pcidev->dev //USE
Fix by changing deltimer() to deltimer_sync().