Re: [PATCH 1/2] devfreq: fix use after free in devfreq_remove_device

["Rafael J. Wysocki" <rjw@sisk.pl>]

On Thursday, November 10, 2011, 함명주 wrote:
> Sender : Axel Lin<axel.lin@gmail.com> Date : 2011-11-10 16:28 (GMT+09:00)
> > In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
> > Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.
> > 
> > Signed-off-by: Axel Lin <axel.lin@gmail.com>
> 
> Thank you for finding that out.
> 
> Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>

Applied to linux-pm/pm-fixes.

Thanks,
Rafael


> > ---
> > drivers/devfreq/devfreq.c |    8 ++++++--
> > 1 files changed, 6 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
> > index d065925..59d24e9 100644
> > --- a/drivers/devfreq/devfreq.c
> > +++ b/drivers/devfreq/devfreq.c
> > @@ -418,10 +418,14 @@ out:
> >   */
> > int devfreq_remove_device(struct devfreq *devfreq)
> > {
> > + bool central_polling;
> > +
> > if (!devfreq)
> > return -EINVAL;
> > 
> > - if (!devfreq->governor->no_central_polling) {
> > + central_polling = !devfreq->governor->no_central_polling;
> > +
> > + if (central_polling) {
> > mutex_lock(&devfreq_list_lock);
> > while (wait_remove_device == devfreq) {
> > mutex_unlock(&devfreq_list_lock);
> > @@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
> > mutex_lock(&devfreq->lock);
> > _remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
> > 
> > - if (!devfreq->governor->no_central_polling)
> > + if (central_polling)
> > mutex_unlock(&devfreq_list_lock);
> > 
> > return 0;
> 
>  MyungJoo Ham (함명주)
> 
> Mobile Software Platform Lab,
> Digital Media and Communications (DMC) Business
> Samsung Electronics
> cell: +82-10-6714-2858 / office: +82-31-279-8033