[lkml]   [2017]   [Sep]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [GIT PULL 1/3] stm class: Fix a use-after-free
On Tue, Sep 19, 2017 at 06:47:40PM +0300, Alexander Shishkin wrote:
> For reasons unknown, the stm_source removal path uses device_destroy()
> to kill the underlying device object. Because device_destroy() uses
> devt to look for the device to destroy and the fact that stm_source
> devices don't have one (or all have the same one), it just picks the
> first device in the class, which may well be the wrong one.
> That is, loading stm_console and stm_heartbeat and then removing both
> will die in dereferencing a freed object.
> Since this should have been device_unregister() in the first place,
> use it instead of device_destroy().
> Signed-off-by: Alexander Shishkin <>
> Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices")
> Cc:
> ---
> drivers/hwtracing/stm/core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)

Ugh, I just applied these as patches, and didn't do the git pull, sorry
about that, my fault.

But really, patches for short series are really easy for me to do...


greg k-h

 \ /
  Last update: 2017-09-22 10:29    [W:0.069 / U:1.468 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site