lkml.org 
[lkml]   [2010]   [Oct]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[006/103] ALSA: rawmidi: fix oops (use after free) when unloading a driver module
    2.6.35-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Clemens Ladisch <clemens@ladisch.de>

    commit aa73aec6c385e2c797ac25cc7ccf0318031de7c8 upstream.

    When a driver module is unloaded and the last still open file is a raw
    MIDI device, the card and its devices will be actually freed in the
    snd_card_file_remove() call when that file is closed. Afterwards, rmidi
    and rmidi->card point into freed memory, so the module pointer is likely
    to be garbage.
    (This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.)

    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Reported-by: Krzysztof Foltman <wdev@foltman.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    sound/core/rawmidi.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/sound/core/rawmidi.c
    +++ b/sound/core/rawmidi.c
    @@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct in
    {
    struct snd_rawmidi_file *rfile;
    struct snd_rawmidi *rmidi;
    + struct module *module;

    rfile = file->private_data;
    rmidi = rfile->rmidi;
    rawmidi_release_priv(rfile);
    kfree(rfile);
    + module = rmidi->card->module;
    snd_card_file_remove(rmidi->card, file);
    - module_put(rmidi->card->module);
    + module_put(module);
    return 0;
    }




    \
     
     \ /
      Last update: 2010-10-22 21:27    [W:0.019 / U:30.676 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site