From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
To: Yadwinder Singh Brar <yadi.brar01@gmail.com>
Cc: Mike Turquette <mturquette@linaro.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
Kyungmin Park <kyungmin.park@samsung.com>,
Marek Szyprowski <m.szyprowski@samsung.com>,
Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>,
Tomasz Figa <t.figa@samsung.com>,
Yadwinder Singh Brar <yadi.brar@samsung.com>,
Tushar Behera <tushar.behera@linaro.org>
Subject: Re: [PATCH] clk: s2mps11: Fix double free corruption during driver unbind
Date: Fri, 27 Jun 2014 14:03:14 +0200 [thread overview]
Message-ID: <1403870594.3872.0.camel@AMDC1943> (raw)
In-Reply-To: <CAKew6eWEnQkfWJfhNXnHGbDc5j8nmGBsKb48DvdS-jud-sKLBA@mail.gmail.com>
On pią, 2014-06-27 at 17:19 +0530, Yadwinder Singh Brar wrote:
> Hi Krzystof,
>
> On Fri, Jun 27, 2014 at 4:04 PM, Krzysztof Kozlowski
> <k.kozlowski@samsung.com> wrote:
> > After unbinding the driver memory was corrupted by double free of
> > clk_lookup structure. This lead to OOPS when re-binding the driver
> > again.
> >
> > The driver allocated memory for 'clk_lookup' with devm_kzalloc. During
> > driver removal this memory was freed twice: once by clkdev_drop() and
> > second by devm code.
> >
>
> Ideally memory should be allocated and deallocated in same place
> either driver or framework, so in this case if framework(clkdev_drop)
> deallocates memory, framework itself should also allocate it.
> So IMO this bug should be fixed using clkdev_alloc() instead of kzalloc().
>
You're right, I'll send fixed version. Thanks for idea.
Best regards,
Krzysztof
prev parent reply other threads:[~2014-06-27 12:03 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-06-27 10:34 [PATCH] clk: s2mps11: Fix double free corruption during driver unbind Krzysztof Kozlowski
2014-06-27 11:49 ` Yadwinder Singh Brar
2014-06-27 12:03 ` Krzysztof Kozlowski [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1403870594.3872.0.camel@AMDC1943 \
--to=k.kozlowski@samsung.com \
--cc=b.zolnierkie@samsung.com \
--cc=kyungmin.park@samsung.com \
--cc=linux-kernel@vger.kernel.org \
--cc=m.szyprowski@samsung.com \
--cc=mturquette@linaro.org \
--cc=t.figa@samsung.com \
--cc=tushar.behera@linaro.org \
--cc=yadi.brar01@gmail.com \
--cc=yadi.brar@samsung.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox