linux-kernel - Re: [PATCH 1/2] devfreq: fix use after free in devfreq_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 15 Nov 2011 00:18:22 +0100
From:	"Rafael J. Wysocki" <rjw@...k.pl>
To:	myungjoo.ham@...sung.com
Cc:	Axel Lin <axel.lin@...il.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Kevin Hilman <khilman@...com>,
	박경민 <kyungmin.park@...sung.com>,
	Mike Turquette <mturquette@...com>
Subject: Re: [PATCH 1/2] devfreq: fix use after free in devfreq_remove_device

On Thursday, November 10, 2011, 함명주 wrote:
> Sender : Axel Lin<axel.lin@...il.com> Date : 2011-11-10 16:28 (GMT+09:00)
> > In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
> > Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.
> > 
> > Signed-off-by: Axel Lin <axel.lin@...il.com>
> 
> Thank you for finding that out.
> 
> Acked-by: MyungJoo Ham <myungjoo.ham@...sung.com>

Applied to linux-pm/pm-fixes.

Thanks,
Rafael


> > ---
> > drivers/devfreq/devfreq.c |    8 ++++++--
> > 1 files changed, 6 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
> > index d065925..59d24e9 100644
> > --- a/drivers/devfreq/devfreq.c
> > +++ b/drivers/devfreq/devfreq.c
> > @@ -418,10 +418,14 @@ out:
> >   */
> > int devfreq_remove_device(struct devfreq *devfreq)
> > {
> > + bool central_polling;
> > +
> > if (!devfreq)
> > return -EINVAL;
> > 
> > - if (!devfreq->governor->no_central_polling) {
> > + central_polling = !devfreq->governor->no_central_polling;
> > +
> > + if (central_polling) {
> > mutex_lock(&devfreq_list_lock);
> > while (wait_remove_device == devfreq) {
> > mutex_unlock(&devfreq_list_lock);
> > @@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
> > mutex_lock(&devfreq->lock);
> > _remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
> > 
> > - if (!devfreq->governor->no_central_polling)
> > + if (central_polling)
> > mutex_unlock(&devfreq_list_lock);
> > 
> > return 0;
> 
>  MyungJoo Ham (함명주)
> 
> Mobile Software Platform Lab,
> Digital Media and Communications (DMC) Business
> Samsung Electronics
> cell: +82-10-6714-2858 / office: +82-31-279-8033

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/