linux-kernel - kobject_put vs module unload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 7 Jan 2011 22:42:22 -0500 (EST)
From:	Mikulas Patocka <mpatocka@...hat.com>
To:	Greg Kroah-Hartman <gregkh@...e.de>
cc:	linux-kernel@...r.kernel.org, dm-devel@...hat.com
Subject: kobject_put vs module unload

Hi

I'm looking at some kobject problem in device mapper and I came across 
this problem:

According to kobject interface specification, If we embed a kobject into 
the device structure, we shouldn't free the device structure when the 
device is unloaded, but we should register a "release" callback in 
kobj_type that will actually free the device structure.

What happens in this scenario?:

1) someone references a device kobject
2) the device is unloaded (but the device structure is still in memory 
because of that reference)
3) the driver module is unloaded
4) the reference obtained at point 1) is dropped, kobject reference count 
reaches zero and the release callback is called. But that callback points 
to an unloaded module and causes a crash.

How is it solved? Am I missing something?

Mikulas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/