lkml.org 
[lkml]   [2010]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[24/93] CPUFREQ: Fix use after free of struct powernow_k8_data
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Thomas Renninger <trenn@suse.de>

    commit 557a701c16553b0b691dbb64ef30361115a80f64 upstream.

    Easy fix for a regression introduced in 2.6.31.

    On managed CPUs the cpufreq.c core will call driver->exit(cpu) on the
    managed cpus and powernow_k8 will free the core's data.

    Later driver->get(cpu) function might get called trying to read out the
    current freq of a managed cpu and the NULL pointer check does not work on
    the freed object -> better set it to NULL.

    ->get() is unsigned and must return 0 as invalid frequency.

    Reference:
    http://bugzilla.kernel.org/show_bug.cgi?id=14391

    Signed-off-by: Thomas Renninger <trenn@suse.de>
    Tested-by: Michal Schmidt <mschmidt@redhat.com>
    Signed-off-by: Dave Jones <davej@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    arch/x86/kernel/cpu/cpufreq/powernow-k8.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
    +++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
    @@ -1351,6 +1351,7 @@ static int __devexit powernowk8_cpu_exit

    kfree(data->powernow_table);
    kfree(data);
    + per_cpu(powernow_data, pol->cpu) = NULL;

    return 0;
    }
    @@ -1370,7 +1371,7 @@ static unsigned int powernowk8_get(unsig
    int err;

    if (!data)
    - return -EINVAL;
    + return 0;

    smp_call_function_single(cpu, query_values_on_cpu, &err, true);
    if (err)



    \
     
     \ /
      Last update: 2010-02-19 18:15    [W:0.023 / U:31.192 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site