lkml.org 
[lkml]   [2003]   [Sep]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [OOPS][RESEND] 2.6.0-test4-mm4
Bongani Hlope <bonganilinux@mweb.co.za> wrote:
>
> > Is it repeatable? Exactly which modules were you attempting to load at the
> > time? And please send your .config.
> >
> > Thanks.
>
>
> This is repeatable, each time it tries to load the alsa snd module.

OK, it's a straightforward use-after-free in kobject_cleanup(). I snarfed
a patch from Pat which allows arbitrary-length kobject names. Maybe it
wasn't quite ready yet.

t->release points at cdev_dynamic_release(), which frees the kobj.

This should fix it up.

lib/kobject.c | 13 ++++++++++---
1 files changed, 10 insertions(+), 3 deletions(-)

diff -puN lib/kobject.c~kobject-unlimited-name-lengths-use-after-free-fix lib/kobject.c
--- 25/lib/kobject.c~kobject-unlimited-name-lengths-use-after-free-fix 2003-09-01 22:20:27.000000000 -0700
+++ 25-akpm/lib/kobject.c 2003-09-01 22:28:00.000000000 -0700
@@ -443,15 +443,22 @@ void kobject_cleanup(struct kobject * ko
{
struct kobj_type * t = get_ktype(kobj);
struct kset * s = kobj->kset;
+ char *name = NULL;

pr_debug("kobject %s: cleaning up\n",kobject_name(kobj));
+
+ if (kobj->k_name != kobj->name)
+ name = kobj->k_name;
+
if (t && t->release)
t->release(kobj);
if (s)
kset_put(s);
- if (kobj->k_name != kobj->name)
- kfree(kobj->k_name);
- kobj->k_name = NULL;
+
+ if (name)
+ kfree(name);
+ else
+ kobj->k_name = NULL;
}

/**
_

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:48    [W:0.051 / U:1.780 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site