Messages in this thread | | | Date | Fri, 19 Oct 2012 18:09:51 +0100 | From | Al Viro <> | Subject | Re: weird use-after-free bug in module_put |
| |
On Fri, Oct 19, 2012 at 09:33:18AM -0700, Dmitry Torokhov wrote:
> We are now removing instance of character device corresponding to input > device when input device disappears. > > Ah, I know... cdev is embedded in evdev, but lives longer.. I do want to > keep cdev embedded as it allows me to easily get to evdev in > evdev_open(), but I need to be able to add and then drop reference to > evdev from cdev's ->release() method. This means I need to override it. > > Or I could have cdev separately allocated, but then I'd like to have a > void pointer in "struct cdev" so I could get from it back to > corresponding evdev.
Your real problem is that you have two kobjects embedded into the same thing. It can work, but you need to make the secondary (one that does *not* free in its ->release()) pin the primary. Sigh... Device model sucks, film at 11...
| |