Messages in this thread Patch in this message | | | Date | Tue, 15 Jul 2008 17:09:03 +0900 | From | Akinobu Mita <> | Subject | [PATCH] intel_cacheinfo: fix use-after-free cache_kobject |
| |
This avoids calling kobject_uevent() with cache_kobject that has already been deallocated in an error path.
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: "H. Peter Anvin" <hpa@zytor.com> --- arch/x86/kernel/cpu/intel_cacheinfo.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
Index: 2.6-mmotm/arch/x86/kernel/cpu/intel_cacheinfo.c =================================================================== --- 2.6-mmotm.orig/arch/x86/kernel/cpu/intel_cacheinfo.c +++ 2.6-mmotm/arch/x86/kernel/cpu/intel_cacheinfo.c @@ -780,15 +780,14 @@ static int __cpuinit cache_add_dev(struc } kobject_put(per_cpu(cache_kobject, cpu)); cpuid4_cache_sysfs_exit(cpu); - break; + return retval; } kobject_uevent(&(this_object->kobj), KOBJ_ADD); } - if (!retval) - cpu_set(cpu, cache_dev_map); + cpu_set(cpu, cache_dev_map); kobject_uevent(per_cpu(cache_kobject, cpu), KOBJ_ADD); - return retval; + return 0; } static void __cpuinit cache_remove_dev(struct sys_device * sys_dev)
| |