linux-kernel - Re: [PATCH] acpi: close race in toshiba

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-id: <alpine.LFD.2.00.0811281422070.3204@localhost.localdomain>
Date:	Fri, 28 Nov 2008 14:22:15 -0500 (EST)
From:	Len Brown <lenb@...nel.org>
To:	Arjan van de Ven <arjan@...radead.org>
Cc:	linux-kernel@...r.kernel.org, philipl@...rt.org,
	akpm@...ux-foundation.org
Subject: Re: [PATCH] acpi: close race in toshiba_acpi driver

applied.

thanks,
-Len

On Fri, 28 Nov 2008, Arjan van de Ven wrote:

> 
> From 5d8af90c16de14f5d27c9d0b63118277941ebb4e Mon Sep 17 00:00:00 2001
> From: Arjan van de Ven <arjan@...ux.intel.com>
> Date: Fri, 28 Nov 2008 08:14:14 -0800
> Subject: [PATCH] acpi: close race in toshiba_acpi driver
> 
> the toshiba ACPI driver will, in a failure case, free the rfkill state
> before stopping the polling timer that would use this state. More interesting,
> in the same failure case handling, it calls the exit function, which also
> frees the rfkill state, but after stopping the polling.
> 
> If the race happens, a NULL pointer is passed to rfkill_force_state()
> which then causes a nice dereference.
> 
> Fix the race by just not doing the too-early freeing of the rfkill state.
> 
> This appears to be the cause of a hot issue on kerneloops.org; while I
> have no solid evidence of that this patch will fix the issue, the race
> appears rather real.
> 
> Signed-off-by: Arjan van de Ven <arjan@...ux.intel.com>
> ---
>  drivers/acpi/toshiba_acpi.c |    2 --
>  1 files changed, 0 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/acpi/toshiba_acpi.c b/drivers/acpi/toshiba_acpi.c
> index 66aac06..25f531d 100644
> --- a/drivers/acpi/toshiba_acpi.c
> +++ b/drivers/acpi/toshiba_acpi.c
> @@ -848,8 +848,6 @@ static int __init toshiba_acpi_init(void)
>  	ret = input_register_polled_device(toshiba_acpi.poll_dev);
>  	if (ret) {
>  		printk(MY_ERR "unable to register kill-switch input device\n");
> -		rfkill_free(toshiba_acpi.rfk_dev);
> -		toshiba_acpi.rfk_dev = NULL;
>  		toshiba_acpi_exit();
>  		return ret;
>  	}
> -- 
> 1.6.0.4
> 
> 
> -- 
> Arjan van de Ven 	Intel Open Source Technology Centre
> For development, discussion and tips for power savings, 
> visit http://www.lesswatts.org
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/