[lkml]   [2010]   [Oct]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[006/103] ALSA: rawmidi: fix oops (use after free) when unloading a driver module
    2.6.35-stable review patch.  If anyone has any objections, please let us know.


    From: Clemens Ladisch <>

    commit aa73aec6c385e2c797ac25cc7ccf0318031de7c8 upstream.

    When a driver module is unloaded and the last still open file is a raw
    MIDI device, the card and its devices will be actually freed in the
    snd_card_file_remove() call when that file is closed. Afterwards, rmidi
    and rmidi->card point into freed memory, so the module pointer is likely
    to be garbage.
    (This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.)

    Signed-off-by: Clemens Ladisch <>
    Reported-by: Krzysztof Foltman <>
    Signed-off-by: Takashi Iwai <>
    Signed-off-by: Greg Kroah-Hartman <>

    sound/core/rawmidi.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/sound/core/rawmidi.c
    +++ b/sound/core/rawmidi.c
    @@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct in
    struct snd_rawmidi_file *rfile;
    struct snd_rawmidi *rmidi;
    + struct module *module;

    rfile = file->private_data;
    rmidi = rfile->rmidi;
    + module = rmidi->card->module;
    snd_card_file_remove(rmidi->card, file);
    - module_put(rmidi->card->module);
    + module_put(module);
    return 0;

     \ /
      Last update: 2010-10-22 21:27    [W:0.021 / U:240.240 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site