[lkml]   [2010]   [Oct]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[006/103] ALSA: rawmidi: fix oops (use after free) when unloading a driver module
2.6.35-stable review patch.  If anyone has any objections, please let us know.

From: Clemens Ladisch <>

commit aa73aec6c385e2c797ac25cc7ccf0318031de7c8 upstream.

When a driver module is unloaded and the last still open file is a raw
MIDI device, the card and its devices will be actually freed in the
snd_card_file_remove() call when that file is closed. Afterwards, rmidi
and rmidi->card point into freed memory, so the module pointer is likely
to be garbage.
(This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.)

Signed-off-by: Clemens Ladisch <>
Reported-by: Krzysztof Foltman <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>

sound/core/rawmidi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct in
struct snd_rawmidi_file *rfile;
struct snd_rawmidi *rmidi;
+ struct module *module;

rfile = file->private_data;
rmidi = rfile->rmidi;
+ module = rmidi->card->module;
snd_card_file_remove(rmidi->card, file);
- module_put(rmidi->card->module);
+ module_put(module);
return 0;

 \ /
  Last update: 2010-10-22 21:27    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean