lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 05 Feb 2015 11:30:40 -0800 From: Stephen Boyd <sboyd@...eaurora.org> To: Alban Browaeys <alban.browaeys@...il.com>, Tomeu Vizoso <tomeu.vizoso@...labora.com>, Mike Turquette <mturquette@...aro.org> CC: linux-kernel@...r.kernel.org, Alban Browaeys <prahal@...oo.com> Subject: Re: [PATCH 1/2] clk: Fix __clk_get access to already freed owner field. On 02/05/15 10:24, Alban Browaeys wrote: > On the second call to __set_clk_parents from of_clk_set_defaults, here > when registering the second fimc device the kernel OOPS in an "unhandled > paging request at virtual address 6b6b6b77". This in __clk_get when > dereferencing clk->owner. > > Move the clk free in the kref managed _clk_release call instead of > plain __clk_put. > > Fixes: 035a61c314eb ("clk: Make clk API return per-user struct clk > instances) > > Signed-off-by: Alban Browaeys <prahal@...oo.com> > --- > drivers/clk/clk.c | 17 +++++++++-------- > 1 file changed, 9 insertions(+), 8 deletions(-) > > diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c > index df94668..8f33722 100644 > --- a/drivers/clk/clk.c > +++ b/drivers/clk/clk.c > @@ -2485,15 +2485,18 @@ EXPORT_SYMBOL_GPL(clk_register); > */ > static void __clk_release(struct kref *ref) > { > - struct clk_core *clk = container_of(ref, struct clk_core, ref); > - int i = clk->num_parents; > + struct clk_core *core = container_of(ref, struct clk_core, ref); > + struct clk *clk = container_of(&core, struct clk, core); How does this work? struct clk_core doesn't have a struct clk inside it. > + int i = core->num_parents; > > - kfree(clk->parents); > + kfree(core->parents); > while (--i >= 0) > - kfree_const(clk->parent_names[i]); > + kfree_const(core->parent_names[i]); We don't have kfree_const() in the clk-next tree so please resend based on clk-next, not linux-next. > + > + kfree(core->parent_names); > + kfree_const(core->name); > + kfree(core); > > - kfree(clk->parent_names); > - kfree_const(clk->name); > kfree(clk); > } > > @@ -2671,8 +2674,6 @@ void __clk_put(struct clk *clk) > clk_prepare_unlock(); > > module_put(owner); > - > - kfree(clk); > } > > /*** clk rate change notifiers ***/ I'm still confused. Care to send the actual backtrace and describe which hardware you're running on (perhaps some dts file to look at)? -- Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux Foundation Collaborative Project -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists