From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
To: Yadwinder Singh Brar <yadi.brar01@gmail.com>
Cc: Mike Turquette <mturquette@linaro.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
Kyungmin Park <kyungmin.park@samsung.com>,
Marek Szyprowski <m.szyprowski@samsung.com>,
Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>,
Tomasz Figa <t.figa@samsung.com>,
Yadwinder Singh Brar <yadi.brar@samsung.com>,
Tushar Behera <tushar.behera@linaro.org>
Subject: Re: [PATCH] clk: s2mps11: Fix double free corruption during driver unbind
Date: Fri, 27 Jun 2014 14:03:14 +0200 [thread overview]
Message-ID: <1403870594.3872.0.camel@AMDC1943> (raw)
In-Reply-To: <CAKew6eWEnQkfWJfhNXnHGbDc5j8nmGBsKb48DvdS-jud-sKLBA@mail.gmail.com>
On pią, 2014-06-27 at 17:19 +0530, Yadwinder Singh Brar wrote:
> Hi Krzystof,
>
> On Fri, Jun 27, 2014 at 4:04 PM, Krzysztof Kozlowski
> <k.kozlowski@samsung.com> wrote:
> > After unbinding the driver memory was corrupted by double free of
> > clk_lookup structure. This lead to OOPS when re-binding the driver
> > again.
> >
> > The driver allocated memory for 'clk_lookup' with devm_kzalloc. During
> > driver removal this memory was freed twice: once by clkdev_drop() and
> > second by devm code.
> >
>
> Ideally memory should be allocated and deallocated in same place
> either driver or framework, so in this case if framework(clkdev_drop)
> deallocates memory, framework itself should also allocate it.
> So IMO this bug should be fixed using clkdev_alloc() instead of kzalloc().
>
You're right, I'll send fixed version. Thanks for idea.
Best regards,
Krzysztof
prev parent reply other threads:[~2014-06-27 12:03 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-06-27 10:34 [PATCH] clk: s2mps11: Fix double free corruption during driver unbind Krzysztof Kozlowski
2014-06-27 11:49 ` Yadwinder Singh Brar
2014-06-27 12:03 ` Krzysztof Kozlowski [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1403870594.3872.0.camel@AMDC1943 \
--to=k.kozlowski@samsung.com \
--cc=b.zolnierkie@samsung.com \
--cc=kyungmin.park@samsung.com \
--cc=linux-kernel@vger.kernel.org \
--cc=m.szyprowski@samsung.com \
--cc=mturquette@linaro.org \
--cc=t.figa@samsung.com \
--cc=tushar.behera@linaro.org \
--cc=yadi.brar01@gmail.com \
--cc=yadi.brar@samsung.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.