lkml.org 
[lkml]   [2018]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 087/205] thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs
    Date
    4.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dmitry Osipenko <digetx@gmail.com>

    commit 3c587768271e9c20276522025729e4ebca51583b upstream.

    This patch fixes use-after-free that was detected by KASAN. The bug is
    triggered on a CPUFreq driver module unload by freeing 'cdev' on device
    unregister and then using the freed structure during of the cdev's sysfs
    data destruction. The solution is to unregister the sysfs at first, then
    destroy sysfs data and finally release the cooling device.

    Cc: <stable@vger.kernel.org> # v4.17+
    Fixes: 8ea229511e06 ("thermal: Add cooling device's statistics in sysfs")
    Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
    Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
    Acked-by: Eduardo Valentin <edubezval@gmail.com>
    Signed-off-by: Zhang Rui <rui.zhang@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/thermal/thermal_core.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/thermal/thermal_core.c
    +++ b/drivers/thermal/thermal_core.c
    @@ -1102,8 +1102,9 @@ void thermal_cooling_device_unregister(s
    mutex_unlock(&thermal_list_lock);

    ida_simple_remove(&thermal_cdev_ida, cdev->id);
    - device_unregister(&cdev->device);
    + device_del(&cdev->device);
    thermal_cooling_device_destroy_sysfs(cdev);
    + put_device(&cdev->device);
    }
    EXPORT_SYMBOL_GPL(thermal_cooling_device_unregister);


    \
     
     \ /
      Last update: 2018-11-19 19:04    [W:2.117 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site