Messages in this thread Patch in this message | | | From | ashishsangwan2@gmail ... | Subject | [PATCH] driver core: access dev->driver under dev->mutex in dev_uevent | Date | Wed, 14 Jan 2015 23:40:54 +0530 |
| |
From: Ashish Sangwan <a.sangwan@samsung.com>
We have hit a race condition while parallely accessing device's uevent and rmmoding device's driver. In dev_uevent() first dev->driver is checked if present which becomes true but before calling add_uevent_var dev->driver is set to NULL and driver is freed in __device_release_driver(). This results in either NULL pointer derefrence or invalid virtual address access. Fix this race by accessing dev->driver under dev->mutex.
Signed-off-by: Ashish Sangwan <a.sangwan@samsung.com> Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com> --- drivers/base/core.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/drivers/base/core.c b/drivers/base/core.c index 97e2baf..f8e854a 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -326,8 +326,15 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj, if (dev->type && dev->type->name) add_uevent_var(env, "DEVTYPE=%s", dev->type->name); + /* + * dev->driver is set NULL under dev->mutex so it should be checked + * after acquiring dev->mutex. This prevents a race between + * __device_release_driver and dev_uevent. + */ + device_lock(dev); if (dev->driver) add_uevent_var(env, "DRIVER=%s", dev->driver->name); + device_unlock(dev); /* Add common DT information about the device */ of_device_uevent(dev, env); -- 1.7.11.4
| |