From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751883AbdIVI2u (ORCPT ); Fri, 22 Sep 2017 04:28:50 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:36469 "EHLO out1-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751845AbdIVI2q (ORCPT ); Fri, 22 Sep 2017 04:28:46 -0400 X-ME-Sender: X-Sasl-enc: GEw0iEGvnrC8FA8GRusm0iFdudcGvFe//UkK0Aw7qJV4 1506068925 Date: Fri, 22 Sep 2017 10:28:57 +0200 From: Greg KH To: Alexander Shishkin Cc: Mathieu Poirier , Chunyan Zhang , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [GIT PULL 1/3] stm class: Fix a use-after-free Message-ID: <20170922082857.GA26322@kroah.com> References: <20170919154742.19696-1-alexander.shishkin@linux.intel.com> <20170919154742.19696-2-alexander.shishkin@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170919154742.19696-2-alexander.shishkin@linux.intel.com> User-Agent: Mutt/1.9.0 (2017-09-02) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Sep 19, 2017 at 06:47:40PM +0300, Alexander Shishkin wrote: > For reasons unknown, the stm_source removal path uses device_destroy() > to kill the underlying device object. Because device_destroy() uses > devt to look for the device to destroy and the fact that stm_source > devices don't have one (or all have the same one), it just picks the > first device in the class, which may well be the wrong one. > > That is, loading stm_console and stm_heartbeat and then removing both > will die in dereferencing a freed object. > > Since this should have been device_unregister() in the first place, > use it instead of device_destroy(). > > Signed-off-by: Alexander Shishkin > Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices") > Cc: stable@vger.kernel.org > --- > drivers/hwtracing/stm/core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Ugh, I just applied these as patches, and didn't do the git pull, sorry about that, my fault. But really, patches for short series are really easy for me to do... thanks, greg k-h