linux-kernel - Re: [PATCH 1/2] devfreq: fix use after free in devfreq_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 10 Nov 2011 08:15:15 +0000 (GMT)
From:	함명주 <myungjoo.ham@...sung.com>
To:	Axel Lin <axel.lin@...il.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc:	Kevin Hilman <khilman@...com>,
	박경민 <kyungmin.park@...sung.com>,
	Mike Turquette <mturquette@...com>,
	"Rafael J. Wysocki" <rjw@...k.pl>
Subject: Re: [PATCH 1/2] devfreq: fix use after free in devfreq_remove_device

Sender : Axel Lin<axel.lin@...il.com> Date : 2011-11-10 16:28 (GMT+09:00)
> In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
> Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.
> 
> Signed-off-by: Axel Lin <axel.lin@...il.com>

Thank you for finding that out.

Acked-by: MyungJoo Ham <myungjoo.ham@...sung.com>

> ---
> drivers/devfreq/devfreq.c |    8 ++++++--
> 1 files changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
> index d065925..59d24e9 100644
> --- a/drivers/devfreq/devfreq.c
> +++ b/drivers/devfreq/devfreq.c
> @@ -418,10 +418,14 @@ out:
>   */
> int devfreq_remove_device(struct devfreq *devfreq)
> {
> + bool central_polling;
> +
> if (!devfreq)
> return -EINVAL;
> 
> - if (!devfreq->governor->no_central_polling) {
> + central_polling = !devfreq->governor->no_central_polling;
> +
> + if (central_polling) {
> mutex_lock(&devfreq_list_lock);
> while (wait_remove_device == devfreq) {
> mutex_unlock(&devfreq_list_lock);
> @@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
> mutex_lock(&devfreq->lock);
> _remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
> 
> - if (!devfreq->governor->no_central_polling)
> + if (central_polling)
> mutex_unlock(&devfreq_list_lock);
> 
> return 0;
> -- 
> 1.7.5.4

 MyungJoo Ham (함명주)

Mobile Software Platform Lab,
Digital Media and Communications (DMC) Business
Samsung Electronics
cell: +82-10-6714-2858 / office: +82-31-279-8033