Commit d953e0e8 authored by George Spelvin's avatar George Spelvin Committed by Greg Kroah-Hartman

pps: Fix a use-after free bug when unregistering a source.

Remove the cdev from the system (with cdev_del) *before* deallocating it
(in pps_device_destruct, called via kobject_put from device_destroy).

Also prevent deallocating a device with open file handles.

A better long-term fix is probably to remove the cdev from the pps_device
entirely, and instead have all devices reference one global cdev.  Then
the deallocation ordering becomes simpler.

But that's more complex and invasive change, so we leave that
for later.
Signed-off-by: default avatarGeorge Spelvin <linux@horizon.com>
Cc: stable <stable@vger.kernel.org>
Acked-by: default avatarRodolfo Giometti <giometti@enneenne.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 03a7ffe4
...@@ -247,12 +247,15 @@ static int pps_cdev_open(struct inode *inode, struct file *file) ...@@ -247,12 +247,15 @@ static int pps_cdev_open(struct inode *inode, struct file *file)
struct pps_device *pps = container_of(inode->i_cdev, struct pps_device *pps = container_of(inode->i_cdev,
struct pps_device, cdev); struct pps_device, cdev);
file->private_data = pps; file->private_data = pps;
kobject_get(&pps->dev->kobj);
return 0; return 0;
} }
static int pps_cdev_release(struct inode *inode, struct file *file) static int pps_cdev_release(struct inode *inode, struct file *file)
{ {
struct pps_device *pps = container_of(inode->i_cdev,
struct pps_device, cdev);
kobject_put(&pps->dev->kobj);
return 0; return 0;
} }
...@@ -274,8 +277,10 @@ static void pps_device_destruct(struct device *dev) ...@@ -274,8 +277,10 @@ static void pps_device_destruct(struct device *dev)
{ {
struct pps_device *pps = dev_get_drvdata(dev); struct pps_device *pps = dev_get_drvdata(dev);
/* release id here to protect others from using it while it's cdev_del(&pps->cdev);
* still in use */
/* Now we can release the ID for re-use */
pr_debug("deallocating pps%d\n", pps->id);
mutex_lock(&pps_idr_lock); mutex_lock(&pps_idr_lock);
idr_remove(&pps_idr, pps->id); idr_remove(&pps_idr, pps->id);
mutex_unlock(&pps_idr_lock); mutex_unlock(&pps_idr_lock);
...@@ -332,6 +337,7 @@ int pps_register_cdev(struct pps_device *pps) ...@@ -332,6 +337,7 @@ int pps_register_cdev(struct pps_device *pps)
goto del_cdev; goto del_cdev;
} }
/* Override the release function with our own */
pps->dev->release = pps_device_destruct; pps->dev->release = pps_device_destruct;
pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pr_debug("source %s got cdev (%d:%d)\n", pps->info.name,
...@@ -352,9 +358,9 @@ int pps_register_cdev(struct pps_device *pps) ...@@ -352,9 +358,9 @@ int pps_register_cdev(struct pps_device *pps)
void pps_unregister_cdev(struct pps_device *pps) void pps_unregister_cdev(struct pps_device *pps)
{ {
pr_debug("unregistering pps%d\n", pps->id);
pps->lookup_cookie = NULL; pps->lookup_cookie = NULL;
device_destroy(pps_class, pps->dev->devt); device_destroy(pps_class, pps->dev->devt);
cdev_del(&pps->cdev);
} }
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment