Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1737260

Re: [GIT PULL 1/3] stm class: Fix a use-after-free

From Greg KH <greg@kroah.com>
Newsgroups linux.kernel
Subject Re: [GIT PULL 1/3] stm class: Fix a use-after-free
Date 2017-09-22 10:30 +0200
Message-ID <usrvr-3Q3-1@gated-at.bofh.it> (permalink)
References <ursWC-7h8-13@gated-at.bofh.it> <ursWC-7h8-19@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


On Tue, Sep 19, 2017 at 06:47:40PM +0300, Alexander Shishkin wrote:
> For reasons unknown, the stm_source removal path uses device_destroy()
> to kill the underlying device object. Because device_destroy() uses
> devt to look for the device to destroy and the fact that stm_source
> devices don't have one (or all have the same one), it just picks the
> first device in the class, which may well be the wrong one.
> 
> That is, loading stm_console and stm_heartbeat and then removing both
> will die in dereferencing a freed object.
> 
> Since this should have been device_unregister() in the first place,
> use it instead of device_destroy().
> 
> Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices")
> Cc: stable@vger.kernel.org
> ---
>  drivers/hwtracing/stm/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Ugh, I just applied these as patches, and didn't do the git pull, sorry
about that, my fault.

But really, patches for short series are really easy for me to do...

thanks,

greg k-h

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[GIT PULL 0/3] intel_th/stm class: Fixes for v4.14 Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2017-09-19 17:50 +0200
  [GIT PULL 1/3] stm class: Fix a use-after-free Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2017-09-19 17:50 +0200
    Re: [GIT PULL 1/3] stm class: Fix a use-after-free Greg KH <greg@kroah.com> - 2017-09-22 10:30 +0200
      Re: [GIT PULL 1/3] stm class: Fix a use-after-free Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2017-09-22 11:10 +0200
  [GIT PULL 3/3] intel_th: pci: Add Lewisburg PCH support Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2017-09-19 18:00 +0200
  [GIT PULL 2/3] intel_th: pci: Add Cedar Fork PCH support Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2017-09-19 18:00 +0200

csiph-web