![]() | |||||||||||||
Messages in this thread |
Hi all, I've spotted a case where functions marked as __devinit may be used after being freed. 8250_pci.c contains find_quirk() which is accessing pci_serial_quirks[]. The functions pointed to by pci_serial_quirks[x].init are marked as __devinit. 8250_pci.c exports pciserial_init_ports() which is using find_quirk(). pciserial_init_ports() may be used after __devinit data has been freed from the module. If parport_serial gets loaded after 8250_pci and CONFIG_HOTPLUG is disabled and the quirk table is matching then we might call a non-existing function. I may of course be wrong, but it does look like a use-after-free problem to me. I discovered this by running modpost on a vmlinux that contains relocation information. / magnus - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2006-07-03 09:53 [from the cache] ©2003-2008 | |||||||||||||