[patch 1/7] Driver core: potentially fix use after free in class_device_attr_show

Greg Kroah-Hartman
2005-08-16T22:16:21Z

[-- Attachment #1: driver-use-after-free-fix-for-class_device_attr_show.patch --]
[-- Type: text/plain, Size: 1314 bytes --]

From: Maneesh Soni <maneesh@in.ibm.com>

o moves the code to free devt_attr from class_device_del() to
class_dev_release() which is called after the last reference to the
corresponding kobject() is gone. This allows to keep the devt_attr
alive while the corresponding sysfs file is open.

Signed-off-by: Maneesh Soni <maneesh@in.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/base/class.c | 10 ++++++----
1 files changed, 6 insertions(+), 4 deletions(-)

--- gregkh-2.6.orig/drivers/base/class.c 2005-08-16 14:51:44.000000000 -0700
+++ gregkh-2.6/drivers/base/class.c 2005-08-16 14:56:58.000000000 -0700
@@ -299,6 +299,11 @@ static void class_dev_release(struct kob

pr_debug("device class '%s': release.\n", cd->class_id);

+ if (cd->devt_attr) {
+ kfree(cd->devt_attr);
+ cd->devt_attr = NULL;
+ }
+
if (cls->release)
cls->release(cd);
else {
@@ -591,11 +596,8 @@ void class_device_del(struct class_devic

if (class_dev->dev)
sysfs_remove_link(&class_dev->kobj, "device");
- if (class_dev->devt_attr) {
+ if (class_dev->devt_attr)
class_device_remove_file(class_dev, class_dev->devt_attr);
- kfree(class_dev->devt_attr);
- class_dev->devt_attr = NULL;
- }
class_device_remove_attrs(class_dev);

kobject_hotplug(&class_dev->kobj, KOBJ_REMOVE);

--