From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751698AbdISPsq (ORCPT ); Tue, 19 Sep 2017 11:48:46 -0400 Received: from mga01.intel.com ([192.55.52.88]:7659 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751377AbdISPso (ORCPT ); Tue, 19 Sep 2017 11:48:44 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.42,418,1500966000"; d="scan'208";a="1173805086" From: Alexander Shishkin To: Greg KH Cc: Mathieu Poirier , Chunyan Zhang , linux-kernel@vger.kernel.org, Alexander Shishkin , stable@vger.kernel.org Subject: [GIT PULL 1/3] stm class: Fix a use-after-free Date: Tue, 19 Sep 2017 18:47:40 +0300 Message-Id: <20170919154742.19696-2-alexander.shishkin@linux.intel.com> X-Mailer: git-send-email 2.13.1 In-Reply-To: <20170919154742.19696-1-alexander.shishkin@linux.intel.com> References: <20170919154742.19696-1-alexander.shishkin@linux.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org For reasons unknown, the stm_source removal path uses device_destroy() to kill the underlying device object. Because device_destroy() uses devt to look for the device to destroy and the fact that stm_source devices don't have one (or all have the same one), it just picks the first device in the class, which may well be the wrong one. That is, loading stm_console and stm_heartbeat and then removing both will die in dereferencing a freed object. Since this should have been device_unregister() in the first place, use it instead of device_destroy(). Signed-off-by: Alexander Shishkin Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices") Cc: stable@vger.kernel.org --- drivers/hwtracing/stm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c index 9414900575..f129869e05 100644 --- a/drivers/hwtracing/stm/core.c +++ b/drivers/hwtracing/stm/core.c @@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data) stm_source_link_drop(src); - device_destroy(&stm_source_class, src->dev.devt); + device_unregister(&src->dev); } EXPORT_SYMBOL_GPL(stm_source_unregister_device); -- 2.14.1