* [GIT PULL 1/3] stm class: Fix a use-after-free
2017-09-19 15:47 [GIT PULL 0/3] intel_th/stm class: Fixes for v4.14 Alexander Shishkin
@ 2017-09-19 15:47 ` Alexander Shishkin
2017-09-22 8:28 ` Greg KH
2017-09-19 15:47 ` [GIT PULL 2/3] intel_th: pci: Add Cedar Fork PCH support Alexander Shishkin
2017-09-19 15:47 ` [GIT PULL 3/3] intel_th: pci: Add Lewisburg " Alexander Shishkin
2 siblings, 1 reply; 6+ messages in thread
From: Alexander Shishkin @ 2017-09-19 15:47 UTC (permalink / raw)
To: Greg KH
Cc: Mathieu Poirier, Chunyan Zhang, linux-kernel, Alexander Shishkin,
stable
For reasons unknown, the stm_source removal path uses device_destroy()
to kill the underlying device object. Because device_destroy() uses
devt to look for the device to destroy and the fact that stm_source
devices don't have one (or all have the same one), it just picks the
first device in the class, which may well be the wrong one.
That is, loading stm_console and stm_heartbeat and then removing both
will die in dereferencing a freed object.
Since this should have been device_unregister() in the first place,
use it instead of device_destroy().
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices")
Cc: stable@vger.kernel.org
---
drivers/hwtracing/stm/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 9414900575..f129869e05 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data)
stm_source_link_drop(src);
- device_destroy(&stm_source_class, src->dev.devt);
+ device_unregister(&src->dev);
}
EXPORT_SYMBOL_GPL(stm_source_unregister_device);
--
2.14.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [GIT PULL 1/3] stm class: Fix a use-after-free
2017-09-19 15:47 ` [GIT PULL 1/3] stm class: Fix a use-after-free Alexander Shishkin
@ 2017-09-22 8:28 ` Greg KH
2017-09-22 9:06 ` Alexander Shishkin
0 siblings, 1 reply; 6+ messages in thread
From: Greg KH @ 2017-09-22 8:28 UTC (permalink / raw)
To: Alexander Shishkin; +Cc: Mathieu Poirier, Chunyan Zhang, linux-kernel, stable
On Tue, Sep 19, 2017 at 06:47:40PM +0300, Alexander Shishkin wrote:
> For reasons unknown, the stm_source removal path uses device_destroy()
> to kill the underlying device object. Because device_destroy() uses
> devt to look for the device to destroy and the fact that stm_source
> devices don't have one (or all have the same one), it just picks the
> first device in the class, which may well be the wrong one.
>
> That is, loading stm_console and stm_heartbeat and then removing both
> will die in dereferencing a freed object.
>
> Since this should have been device_unregister() in the first place,
> use it instead of device_destroy().
>
> Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices")
> Cc: stable@vger.kernel.org
> ---
> drivers/hwtracing/stm/core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Ugh, I just applied these as patches, and didn't do the git pull, sorry
about that, my fault.
But really, patches for short series are really easy for me to do...
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [GIT PULL 1/3] stm class: Fix a use-after-free
2017-09-22 8:28 ` Greg KH
@ 2017-09-22 9:06 ` Alexander Shishkin
0 siblings, 0 replies; 6+ messages in thread
From: Alexander Shishkin @ 2017-09-22 9:06 UTC (permalink / raw)
To: Greg KH; +Cc: Mathieu Poirier, Chunyan Zhang, linux-kernel, stable
Greg KH <greg@kroah.com> writes:
> On Tue, Sep 19, 2017 at 06:47:40PM +0300, Alexander Shishkin wrote:
>> For reasons unknown, the stm_source removal path uses device_destroy()
>> to kill the underlying device object. Because device_destroy() uses
>> devt to look for the device to destroy and the fact that stm_source
>> devices don't have one (or all have the same one), it just picks the
>> first device in the class, which may well be the wrong one.
>>
>> That is, loading stm_console and stm_heartbeat and then removing both
>> will die in dereferencing a freed object.
>>
>> Since this should have been device_unregister() in the first place,
>> use it instead of device_destroy().
>>
>> Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
>> Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices")
>> Cc: stable@vger.kernel.org
>> ---
>> drivers/hwtracing/stm/core.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> Ugh, I just applied these as patches, and didn't do the git pull, sorry
> about that, my fault.
No worries, I'm fine either way.
> But really, patches for short series are really easy for me to do...
Sure, that's one reason why I sent it like that, so you get to choose.
Thanks,
--
Alex
^ permalink raw reply [flat|nested] 6+ messages in thread
* [GIT PULL 2/3] intel_th: pci: Add Cedar Fork PCH support
2017-09-19 15:47 [GIT PULL 0/3] intel_th/stm class: Fixes for v4.14 Alexander Shishkin
2017-09-19 15:47 ` [GIT PULL 1/3] stm class: Fix a use-after-free Alexander Shishkin
@ 2017-09-19 15:47 ` Alexander Shishkin
2017-09-19 15:47 ` [GIT PULL 3/3] intel_th: pci: Add Lewisburg " Alexander Shishkin
2 siblings, 0 replies; 6+ messages in thread
From: Alexander Shishkin @ 2017-09-19 15:47 UTC (permalink / raw)
To: Greg KH
Cc: Mathieu Poirier, Chunyan Zhang, linux-kernel, Alexander Shishkin,
stable
This adds Intel(R) Trace Hub PCI ID for Cedar Fork PCH.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: stable@vger.kernel.org
---
drivers/hwtracing/intel_th/pci.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index bc9cebc305..00ee60d978 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -158,6 +158,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6),
.driver_data = (kernel_ulong_t)&intel_th_2x,
},
+ {
+ /* Cedar Fork PCH */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x18e1),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
{ 0 },
};
--
2.14.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [GIT PULL 3/3] intel_th: pci: Add Lewisburg PCH support
2017-09-19 15:47 [GIT PULL 0/3] intel_th/stm class: Fixes for v4.14 Alexander Shishkin
2017-09-19 15:47 ` [GIT PULL 1/3] stm class: Fix a use-after-free Alexander Shishkin
2017-09-19 15:47 ` [GIT PULL 2/3] intel_th: pci: Add Cedar Fork PCH support Alexander Shishkin
@ 2017-09-19 15:47 ` Alexander Shishkin
2 siblings, 0 replies; 6+ messages in thread
From: Alexander Shishkin @ 2017-09-19 15:47 UTC (permalink / raw)
To: Greg KH
Cc: Mathieu Poirier, Chunyan Zhang, linux-kernel, Alexander Shishkin,
stable
This adds Intel(R) Trace Hub PCI ID for Lewisburg PCH.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: stable@vger.kernel.org
---
drivers/hwtracing/intel_th/pci.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index 00ee60d978..c2a2ce8ee5 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -143,6 +143,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x19e1),
.driver_data = (kernel_ulong_t)0,
},
+ {
+ /* Lewisburg PCH */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa1a6),
+ .driver_data = (kernel_ulong_t)0,
+ },
{
/* Gemini Lake */
PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
--
2.14.1
^ permalink raw reply related [flat|nested] 6+ messages in thread