Messages in this thread | | | Date | Sun, 22 Mar 2020 17:18:16 +0100 | From | Wolfram Sang <> | Subject | Re: BUG: KASAN: i2c dev use after free |
| |
> I think patch introduced this issue d6760b14d4a1 ("i2c: dev: switch > from register_chrdev to cdev API") > and patch e6be18f6d62c ("i2c: dev: use after free in detach") tried to solve it. > However, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled it delays > the ->release callback to make sure that anything that is done in release can > be done later than it happens in normal execution. > The cdev structure is supposed to be freed in the remove callback or after it, > but here it has already been freed by the put_i2c_dev().
For the record, Kevin Hao fixed it and it is now in linux-next as: 1413ef638aba ("i2c: dev: Fix the race between the release of i2c_dev and cdev")
Thanks, Kevin!
[unhandled content-type:application/pgp-signature]
| |