| Date | Tue, 30 Mar 2010 15:57:10 -0700 | From | Greg KH <> | Subject | [08/89] CPUFREQ: Fix use after free of struct powernow_k8_data |
| |
2.6.31-stable review patch. If anyone has any objections, please let us know.
------------------
From: Thomas Renninger <trenn@suse.de>
commit 557a701c16553b0b691dbb64ef30361115a80f64 upstream.
Easy fix for a regression introduced in 2.6.31.
On managed CPUs the cpufreq.c core will call driver->exit(cpu) on the managed cpus and powernow_k8 will free the core's data.
Later driver->get(cpu) function might get called trying to read out the current freq of a managed cpu and the NULL pointer check does not work on the freed object -> better set it to NULL.
->get() is unsigned and must return 0 as invalid frequency.
Reference: http://bugzilla.kernel.org/show_bug.cgi?id=14391
Signed-off-by: Thomas Renninger <trenn@suse.de> Tested-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: Dave Jones <davej@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- arch/x86/kernel/cpu/cpufreq/powernow-k8.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c +++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c @@ -1372,6 +1372,7 @@ static int __devexit powernowk8_cpu_exit kfree(data->powernow_table); kfree(data); + per_cpu(powernow_data, pol->cpu) = NULL; return 0; } @@ -1391,7 +1392,7 @@ static unsigned int powernowk8_get(unsig int err; if (!data) - return -EINVAL; + return 0; smp_call_function_single(cpu, query_values_on_cpu, &err, true); if (err)
|