Re: [PATCH] driver core : Fix use after free of dev->parent in device_shutdown

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Sep 24, 2013 at 02:39:08PM -0700, Benson Leung wrote:
> The put_device(dev) at the bottom of the loop of device_shutdown
> may result in the dev being cleaned up. In device_create_release,
> the dev is kfreed.
> 
> However, device_shutdown attempts to use the dev pointer again after
> put_device by referring to dev->parent.
> 
> Copy the parent pointer instead to avoid this condition.
> 
> This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11.
> See bug report : https://code.google.com/p/chromium/issues/detail?id=297842
> This can easily be reproduced when shutting down with
> hidraw devices that report battery condition.
> Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse.
> For example, with the magic mouse :
> The dev in question is "hidraw0"
> dev->parent is "magicmouse"
> 
> In the course of the shutdown for this device, the input event cleanup calls
> a put on hidraw0, decrementing its reference count.
> When we finally get to put_device(dev) in device_shutdown, kobject_cleanup
> is called and device_create_release does kfree(dev).
> dev->parent is no longer valid, and we may crash in
> put_device(dev->parent).
> 
> This change should be applied on any kernel with this change :
> d1c6c030fcec6f860d9bb6c632a3ebe62e28440b
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Benson Leung <bleung@chromium.org>

The patch makes sense, but I wonder why no one has ever seen this
problem before.

Odd...

thanks for the fix, I'll queue it up for 3.12-final soon.

greg k-h