]> git.baikalelectronics.ru Git - kernel.git/commit
stm class: Fix a use-after-free
authorAlexander Shishkin <alexander.shishkin@linux.intel.com>
Tue, 19 Sep 2017 15:47:40 +0000 (18:47 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 22 Sep 2017 08:28:00 +0000 (10:28 +0200)
commit261d0bf84310529c184501676c570283e5ea6bb0
tree9c18f05982c5ca1bf03aa706c4d1a96d33d3797d
parentb097d64fff8f18d9c5c5b4e1a2fad56134fc49d5
stm class: Fix a use-after-free

For reasons unknown, the stm_source removal path uses device_destroy()
to kill the underlying device object. Because device_destroy() uses
devt to look for the device to destroy and the fact that stm_source
devices don't have one (or all have the same one), it just picks the
first device in the class, which may well be the wrong one.

That is, loading stm_console and stm_heartbeat and then removing both
will die in dereferencing a freed object.

Since this should have been device_unregister() in the first place,
use it instead of device_destroy().

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: dd93dd1a85d ("stm class: Introduce an abstraction for System Trace Module devices")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/hwtracing/stm/core.c