From: Dmitry Torokhov <dtor@insightbb.com>
To: David Woodhouse <dwmw2@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Marcel Holtmann <marcel@holtmann.org>,
Jiri Kosina <jkosina@suse.cz>,
Michal Piotrowski <michal.k.k.piotrowski@gmail.com>,
LKML <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Greg KH <greg@kroah.com>
Subject: Re: [PATCH] Fix use-after-free oops in Bluetooth HID.
Date: Sun, 8 Jul 2007 22:32:52 -0400 [thread overview]
Message-ID: <200707082232.54034.dtor@insightbb.com> (raw)
In-Reply-To: <1183834720.3066.83.camel@shinybook.infradead.org>
On Saturday 07 July 2007 14:58, David Woodhouse wrote:
> When cleaning up HIDP sessions, we currently close the ACL connection
> before deregistering the input device. Closing the ACL connection
> schedules a workqueue to remove the associated objects from sysfs, but
> the input device still refers to them -- and if the workqueue happens to
> run before the input device removal, the kernel will oops when trying to
> look up PHYSDEVPATH for the removed input device.
>
> Fix this by deregistering the input device before closing the
> connections.
I think it will work ok for 2.6.22 but I don't think this is a final
solution: input_unregister_device might not free the device right away.
If there is a process that hangs on to one of the input interfaces
(evdev or mousedev) then freeing of the device structure may be delayed
and we may still run into the case when session is wiped out before
device is freed.
--
Dmitry
prev parent reply other threads:[~2007-07-09 2:33 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-07-03 16:45 [1/2] 2.6.22-rc7: known regressions Michal Piotrowski
2007-07-03 17:29 ` Sparc32: random invalid instruction occourances on sparc32 (sun4c) Mark Fortescue
2007-07-03 18:57 ` [PATCH] " Mark Fortescue
2007-07-03 19:26 ` David Woodhouse
2007-07-03 21:25 ` Mark Fortescue
2007-07-03 21:56 ` David Woodhouse
2007-07-03 22:47 ` Mark Fortescue
2007-07-03 23:36 ` David Woodhouse
2007-07-04 3:27 ` Mark Fortescue
2007-07-04 3:33 ` David Woodhouse
2007-07-04 10:27 ` Mark Fortescue
2007-07-04 14:46 ` David Woodhouse
2007-07-04 18:38 ` Mark Fortescue
2007-07-03 21:41 ` David Miller
2007-07-03 22:01 ` David Woodhouse
2007-07-03 17:50 ` [1/2] 2.6.22-rc7: known regressions Bartlomiej Zolnierkiewicz
2007-07-03 23:09 ` David Chinner
2007-07-05 0:20 ` David Woodhouse
2007-07-05 1:26 ` [PATCH 2.6.22 REGRESSION] Fix slab redzone alignment David Woodhouse
2007-07-05 1:42 ` [1/2] 2.6.22-rc7: known regressions David Woodhouse
2007-07-05 16:28 ` Linus Torvalds
2007-07-05 16:43 ` David Woodhouse
2007-07-05 18:46 ` David Woodhouse
2007-07-05 19:31 ` David Woodhouse
2007-07-05 19:51 ` Linus Torvalds
2007-07-05 21:03 ` Dmitry Torokhov
2007-07-06 22:50 ` Jiri Kosina
2007-07-07 0:33 ` Dmitry Torokhov
2007-07-07 1:05 ` Jiri Kosina
2007-07-07 1:28 ` David Woodhouse
2007-07-07 2:25 ` David Woodhouse
2007-07-07 18:28 ` Marcel Holtmann
2007-07-07 18:36 ` Linus Torvalds
2007-07-07 18:58 ` [PATCH] Fix use-after-free oops in Bluetooth HID David Woodhouse
2007-07-07 19:27 ` Linus Torvalds
2007-07-09 2:32 ` Dmitry Torokhov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200707082232.54034.dtor@insightbb.com \
--to=dtor@insightbb.com \
--cc=akpm@linux-foundation.org \
--cc=dwmw2@infradead.org \
--cc=greg@kroah.com \
--cc=jkosina@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=michal.k.k.piotrowski@gmail.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox