[PATCH 1/2] devfreq: fix use after free in devfreq_remove_device

[PATCH 1/2] devfreq: fix use after free in devfreq_remove_device

[Axel Lin]

In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
---
 drivers/devfreq/devfreq.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index d065925..59d24e9 100644
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -418,10 +418,14 @@ out:
  */
 int devfreq_remove_device(struct devfreq *devfreq)
 {
+	bool central_polling;
+
 	if (!devfreq)
 		return -EINVAL;
 
-	if (!devfreq->governor->no_central_polling) {
+	central_polling = !devfreq->governor->no_central_polling;
+
+	if (central_polling) {
 		mutex_lock(&devfreq_list_lock);
 		while (wait_remove_device == devfreq) {
 			mutex_unlock(&devfreq_list_lock);
@@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
 	mutex_lock(&devfreq->lock);
 	_remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
 
-	if (!devfreq->governor->no_central_polling)
+	if (central_polling)
 		mutex_unlock(&devfreq_list_lock);
 
 	return 0;
-- 
1.7.5.4

Re: [PATCH 1/2] devfreq: fix use after free in devfreq_remove_device

[함명주]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=euc-kr, Size: 1697 bytes --]

Sender : Axel Lin<axel.lin@gmail.com> Date : 2011-11-10 16:28 (GMT+09:00)
> In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
> Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.
> 
> Signed-off-by: Axel Lin <axel.lin@gmail.com>

Thank you for finding that out.

Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>

> ---
> drivers/devfreq/devfreq.c |    8 ++++++--
> 1 files changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
> index d065925..59d24e9 100644
> --- a/drivers/devfreq/devfreq.c
> +++ b/drivers/devfreq/devfreq.c
> @@ -418,10 +418,14 @@ out:
>   */
> int devfreq_remove_device(struct devfreq *devfreq)
> {
> + bool central_polling;
> +
> if (!devfreq)
> return -EINVAL;
> 
> - if (!devfreq->governor->no_central_polling) {
> + central_polling = !devfreq->governor->no_central_polling;
> +
> + if (central_polling) {
> mutex_lock(&devfreq_list_lock);
> while (wait_remove_device == devfreq) {
> mutex_unlock(&devfreq_list_lock);
> @@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
> mutex_lock(&devfreq->lock);
> _remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
> 
> - if (!devfreq->governor->no_central_polling)
> + if (central_polling)
> mutex_unlock(&devfreq_list_lock);
> 
> return 0;
> -- 
> 1.7.5.4

 MyungJoo Ham (ÇÔ¸íÁÖ)

Mobile Software Platform Lab,
Digital Media and Communications (DMC) Business
Samsung Electronics
cell: +82-10-6714-2858 / office: +82-31-279-8033ÿôèº{.nÇ+‰·Ÿ®‰­†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a­¢f£¢·hšïêÿ‘êçz_è®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨è­Ú&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥

Re: [PATCH 1/2] devfreq: fix use after free in devfreq_remove_device

[Rafael J. Wysocki]

On Thursday, November 10, 2011, 함명주 wrote:
> Sender : Axel Lin<axel.lin@gmail.com> Date : 2011-11-10 16:28 (GMT+09:00)
> > In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
> > Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.
> > 
> > Signed-off-by: Axel Lin <axel.lin@gmail.com>
> 
> Thank you for finding that out.
> 
> Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>

Applied to linux-pm/pm-fixes.

Thanks,
Rafael


> > ---
> > drivers/devfreq/devfreq.c |    8 ++++++--
> > 1 files changed, 6 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
> > index d065925..59d24e9 100644
> > --- a/drivers/devfreq/devfreq.c
> > +++ b/drivers/devfreq/devfreq.c
> > @@ -418,10 +418,14 @@ out:
> >   */
> > int devfreq_remove_device(struct devfreq *devfreq)
> > {
> > + bool central_polling;
> > +
> > if (!devfreq)
> > return -EINVAL;
> > 
> > - if (!devfreq->governor->no_central_polling) {
> > + central_polling = !devfreq->governor->no_central_polling;
> > +
> > + if (central_polling) {
> > mutex_lock(&devfreq_list_lock);
> > while (wait_remove_device == devfreq) {
> > mutex_unlock(&devfreq_list_lock);
> > @@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
> > mutex_lock(&devfreq->lock);
> > _remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
> > 
> > - if (!devfreq->governor->no_central_polling)
> > + if (central_polling)
> > mutex_unlock(&devfreq_list_lock);
> > 
> > return 0;
> 
>  MyungJoo Ham (함명주)
> 
> Mobile Software Platform Lab,
> Digital Media and Communications (DMC) Business
> Samsung Electronics
> cell: +82-10-6714-2858 / office: +82-31-279-8033