Messages in this thread Patch in this message | | | Date | Thu, 10 Nov 2011 08:15:15 +0000 (GMT) | From | 함명주 <> | Subject | Re: [PATCH 1/2] devfreq: fix use after free in devfreq_remove_device |
| |
Sender : Axel Lin<axel.lin@gmail.com> Date : 2011-11-10 16:28 (GMT+09:00) > In devfreq_remove_device, calling _remove_devfreq will also free devfreq. > Don't dereference devfreq->governor->no_central_polling after _remove_devfreq. > > Signed-off-by: Axel Lin <axel.lin@gmail.com>
Thank you for finding that out.
Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
> --- > drivers/devfreq/devfreq.c | 8 ++++++-- > 1 files changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c > index d065925..59d24e9 100644 > --- a/drivers/devfreq/devfreq.c > +++ b/drivers/devfreq/devfreq.c > @@ -418,10 +418,14 @@ out: > */ > int devfreq_remove_device(struct devfreq *devfreq) > { > + bool central_polling; > + > if (!devfreq) > return -EINVAL; > > - if (!devfreq->governor->no_central_polling) { > + central_polling = !devfreq->governor->no_central_polling; > + > + if (central_polling) { > mutex_lock(&devfreq_list_lock); > while (wait_remove_device == devfreq) { > mutex_unlock(&devfreq_list_lock); > @@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq) > mutex_lock(&devfreq->lock); > _remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */ > > - if (!devfreq->governor->no_central_polling) > + if (central_polling) > mutex_unlock(&devfreq_list_lock); > > return 0; > -- > 1.7.5.4
MyungJoo Ham (함명주)
Mobile Software Platform Lab, Digital Media and Communications (DMC) Business Samsung Electronics cell: +82-10-6714-2858 / office: +82-31-279-8033 | |