| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1193415162504-git-send-email-hskinnemoen@atmel.com> Date: Fri, 26 Oct 2007 18:12:42 +0200 From: Haavard Skinnemoen <hskinnemoen@...el.com> To: "Shannon Nelson" <shannon.nelson@...el.com> Cc: "Dan Williams" <dan.j.williams@...el.com>, linux-kernel@...r.kernel.org, akpm@...ux-foundation.org, Haavard Skinnemoen <hskinnemoen@...el.com> Subject: [PATCH] DMA: Fix broken device refcounting When a DMA device is unregistered, its reference count is decremented twice for each channel: Once dma_class_dev_release() and once in dma_chan_cleanup(). This may result in the DMA device driver's remove() function completing before all channels have been cleaned up, causing lots of use-after-free fun. Fix it by incrementing the device's reference count twice for each channel during registration. Signed-off-by: Haavard Skinnemoen <hskinnemoen@...el.com> --- I'm not sure if this is the correct way to solve it, but it seems to work. The remove() function does not hang, which indicates that the device's reference count does drop all the way to zero on unregistration, which in turn indicates that it did actually drop _below_ zero before. drivers/dma/dmaengine.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index 8248992..302eded 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -397,6 +397,8 @@ int dma_async_device_register(struct dma_device *device) goto err_out; } + /* One for the channel, one of the class device */ + kref_get(&device->refcount); kref_get(&device->refcount); kref_init(&chan->refcount); chan->slow_ref = 0; -- 1.5.2.5 - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists