Messages in this thread | | | Date | Fri, 14 Dec 2012 12:50:48 +0100 | From | Borislav Petkov <> | Subject | Re: [PATCH 12/12] edac: fix kernel panic on module unloading |
| |
On Fri, Dec 14, 2012 at 11:26:57AM +0000, Alan Cox wrote: > On Fri, 14 Dec 2012 15:03:10 +0400 > Konstantin Khlebnikov <khlebnikov@openvz.org> wrote: > > > This patch fixes use-after-free and double-free bugs in edac_mc_sysfs_exit(). > > mci_pdev has single reference and put_device() calls mc_attr_release() which > > calls kfree(), thus following device_del() works with already released memory. > > An another kfree() in edac_mc_sysfs_exit() releses the same memory again. Great. > > Patches for this were posted a while ago by Jean Delvare. See bugzilla > 50491 as well for this.
Jean's patch is for i7core_edac but Konstantin's fixes the edac_core which is another module. And AFAICT the correct order of destroying devices in the driver core is
1. _del 2. _put
so I'll pick up Konstantin's patch with a tag for 3.7-stable unless someone has objections?
Thanks.
-- Regards/Gruss, Boris.
Sent from a fat crate under my desk. Formatting is fine. --
| |