linux-kernel - Re: Bad change in commit 297d716f6260cc9421d971b124ca196b957ee458?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-id: <55B6C2D0.1050101@samsung.com>
Date:	Tue, 28 Jul 2015 08:46:24 +0900
From:	Krzysztof Kozlowski <k.kozlowski@...sung.com>
To:	"H.J. Lu" <hjl.tools@...il.com>,
	LKML <linux-kernel@...r.kernel.org>
Cc:	Jiri Kosina <jkosina@...e.com>, linux-input@...r.kernel.org,
	Sebastian Reichel <sre@...nel.org>,
	"linux-pm@...r.kernel.org" <linux-pm@...r.kernel.org>
Subject: Re: Bad change in commit 297d716f6260cc9421d971b124ca196b957ee458?

On 27.07.2015 22:10, H.J. Lu wrote:
> Hi,
> 
> This commit:
> 
> commit 297d716f6260cc9421d971b124ca196b957ee458
> Author: Krzysztof Kozlowski <k.kozlowski@...sung.com>
> Date:   Thu Mar 12 08:44:11 2015 +0100
> 
>     power_supply: Change ownership from driver to core
> 
>     Change the ownership of power_supply structure from each driver
>     implementing the class to the power supply core.
> 
> has
> 
> static void hidinput_cleanup_battery(struct hid_device *dev)
>  {
> -       if (!dev->battery.name)
> +       if (!dev->battery)
>                 return;
> 
> -       power_supply_unregister(&dev->battery);
> -       kfree(dev->battery.name);
> -       dev->battery.name = NULL;
> +       power_supply_unregister(dev->battery);
> +       kfree(dev->battery->desc->name);
> +       kfree(dev->battery->desc);
> +       dev->battery = NULL;
>  }
> 
> Is this OK to access dev->battery after calling power_supply_unregister?

(+Cc Jiri, linux-input, linux-pm, Sebastian)

Good catch, it is not safe. The final device_unregister() will free the
structure.

We should access directly psy_desc here. I'll sent a proposal of fixing
this and check other drivers for this pattern.

Best regards,
Krzysztof
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/