lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 4 May 2013 14:51:16 +0200 From: Pavel Machek <pavel@....cz> To: Shuah Khan <shuah.kh@...sung.com> Cc: "len.brown@...el.com" <len.brown@...el.com>, "rafael.j.wysocki@...el.com" <rafael.j.wysocki@...el.com>, "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>, "linux-pm@...r.kernel.org" <linux-pm@...r.kernel.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "shuahkhan@...il.com" <shuahkhan@...il.com> Subject: Re: [PATCH] PM: Fix dev_pm_put_subsys_data() to not call kfree() while holding device power lock Hi! > dev_pm_put_subsys_data() calls kfree() while holding device power lock, when > the reference count is 0. Fix it to call kfree() after releasing the lock. > > Signed-off-by: Shuah Khan <shuah.kh@...sung.com> > --- > drivers/base/power/common.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > w> diff --git a/drivers/base/power/common.c b/drivers/base/power/common.c > index 39c3252..da05fe2 100644 > --- a/drivers/base/power/common.c > +++ b/drivers/base/power/common.c > @@ -73,13 +73,17 @@ int dev_pm_put_subsys_data(struct device *dev) > > if (--psd->refcount == 0) { > dev->power.subsys_data = NULL; > - kfree(psd); > ret = 1; > } > > out: > spin_unlock_irq(&dev->power.lock); > > + if (ret == 1) { > + /* kfree() verifies that its argument is nonzero. */ > + kfree(psd); > + } > + > return ret; > } Wow, that function is fragile. It returns 0/1/-EINVAL, while being documented for 0/1... Patch does not look obviously wrong, but maybe @@ -73,13 +73,17 @@ int dev_pm_put_subsys_data(struct device *dev) if (--psd->refcount == 0) { dev->power.subsys_data = NULL; + spin_unlock_irq(&dev->power.lock); - kfree(psd); - ret = 1; + return 1; } Would be cleaner. Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists