netdev - [PATCH] phylib: fix premature freeing of struct mii

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081107210617.GS32552@xi.wantstofly.org>
Date:	Fri, 7 Nov 2008 22:06:17 +0100
From:	Lennert Buytenhek <buytenh@...tstofly.org>
To:	jeff@...zik.org
Cc:	netdev@...r.kernel.org
Subject: [PATCH] phylib: fix premature freeing of struct mii_bus

From: Lennert Buytenhek <buytenh@...tstofly.org>

Commit 46abc02175b3c246dd5141d878f565a8725060c9 ("phylib: give mdio
buses a device tree presence") added a call to device_unregister() in
a situation where the caller did not expect the reference count on
the embedded kobject to be dropped, but device_unregister() does drop
that reference count.  The right function to use in this situation
is device_del(), which unregisters the device from the system like
device_unregister() does, but without dropping the reference count.

Bug report from Bryan Wu <cooloney@...nel.org>.

Signed-off-by: Lennert Buytenhek <buytenh@...vell.com>
Tested-by: Bryan Wu <cooloney@...nel.org>
--
2.6.27 is not affected.

diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index d0ed1ef..536bda1 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -136,7 +136,7 @@ void mdiobus_unregister(struct mii_bus *bus)
 	BUG_ON(bus->state != MDIOBUS_REGISTERED);
 	bus->state = MDIOBUS_UNREGISTERED;

-	device_unregister(&bus->dev);
+	device_del(&bus->dev);
 	for (i = 0; i < PHY_MAX_ADDR; i++) {
 		if (bus->phy_map[i])
 			device_unregister(&bus->phy_map[i]->dev);
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html