In the Linux kernel, the following vulnerability has been resolved:sh: push-switch: Reorder cleanup operations to avoid use-after-free bugThe original code puts flush_work() before timer_shutdown_sync()in switch_drv_remove(). Although we use flush_work() to stopthe worker, it could be rescheduled in switch_timer(). As a result,a use-after-free bug can occur. The details are shown below:      (cpu 0)                    |      (cpu 1)switch_drv_remove()              | flush_work()                    |  ...                            |  switch_timer // timer                                 |   schedule_work(&psw->work) timer_shutdown_sync()           | ...                             |  switch_work_handler // worker kfree(psw) // free              |                                 |   psw->state = 0 // useThis patch puts timer_shutdown_sync() before flush_work() tomitigate the bugs. As a result, the worker and timer will bestopped safely before the deallocate operations.
CWE-416 Use After Free