lkml.org 
[lkml]   [2011]   [Nov]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH 1/2] devfreq: fix use after free in devfreq_remove_device
Sender : Axel Lin<axel.lin@gmail.com> Date : 2011-11-10 16:28 (GMT+09:00)
> In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
> Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.
>
> Signed-off-by: Axel Lin <axel.lin@gmail.com>

Thank you for finding that out.

Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>

> ---
> drivers/devfreq/devfreq.c | 8 ++++++--
> 1 files changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
> index d065925..59d24e9 100644
> --- a/drivers/devfreq/devfreq.c
> +++ b/drivers/devfreq/devfreq.c
> @@ -418,10 +418,14 @@ out:
> */
> int devfreq_remove_device(struct devfreq *devfreq)
> {
> + bool central_polling;
> +
> if (!devfreq)
> return -EINVAL;
>
> - if (!devfreq->governor->no_central_polling) {
> + central_polling = !devfreq->governor->no_central_polling;
> +
> + if (central_polling) {
> mutex_lock(&devfreq_list_lock);
> while (wait_remove_device == devfreq) {
> mutex_unlock(&devfreq_list_lock);
> @@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
> mutex_lock(&devfreq->lock);
> _remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
>
> - if (!devfreq->governor->no_central_polling)
> + if (central_polling)
> mutex_unlock(&devfreq_list_lock);
>
> return 0;
> --
> 1.7.5.4

MyungJoo Ham (함명주)

Mobile Software Platform Lab,
Digital Media and Communications (DMC) Business
Samsung Electronics
cell: +82-10-6714-2858 / office: +82-31-279-8033
\
 
 \ /
  Last update: 2011-11-10 09:17    [W:0.045 / U:0.212 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site