You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Benson Leung f123db8e9d driver core : Fix use after free of dev->parent in device_shutdown ... The put_device(dev) at the bottom of the loop of device_shutdown may result in the dev being cleaned up. In device_create_release, the dev is kfreed. However, device_shutdown attempts to use the dev pointer again after put_device by referring to dev->parent. Copy the parent pointer instead to avoid this condition. This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11. See bug report : https://code.google.com/p/chromium/issues/detail?id=297842 This can easily be reproduced when shutting down with hidraw devices that report battery condition. Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse. For example, with the magic mouse : The dev in question is "hidraw0" dev->parent is "magicmouse" In the course of the shutdown for this device, the input event cleanup calls a put on hidraw0, decrementing its reference count. When we finally get to put_device(dev) in device_shutdown, kobject_cleanup is called and device_create_release does kfree(dev). dev->parent is no longer valid, and we may crash in put_device(dev->parent). This change should be applied on any kernel with this change : d1c6c030fc Cc: stable@vger.kernel.org Signed-off-by: Benson Leung <bleung@chromium.org> Reviewed-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		12 years ago
..
power	ACPI and power management updates for 3.12-rc1	12 years ago
regmap	Driver core patches for 3.12-rc1	12 years ago
Kconfig	Merge remote-tracking branch 'dma-public/for-v3.12-cma-dma' into for-next	12 years ago
Makefile	Merge remote-tracking branch 'origin/next' into kvm-ppc-next	12 years ago
attribute_container.c	drivers: avoid format string in dev_set_name	12 years ago
base.h	driver core: bus_type: add drv_groups	12 years ago
bus.c	driver core: add #include <linux/sysfs.h> to core files.	12 years ago
class.c	sysfs.h: remove attr_name() macro	12 years ago
core.c	driver core : Fix use after free of dev->parent in device_shutdown	12 years ago
cpu.c	ACPI and power management updates for 3.12-rc1	12 years ago
dd.c	PM / Runtime: Idle devices asynchronously after probe|release	12 years ago
devres.c	Linux 3.9-rc3	12 years ago
devtmpfs.c	driver core: handle user namespaces properly with the uid/gid devtmpfs change	12 years ago
dma-buf.c	dma-buf: Expose buffer size to userspace (v2)	12 years ago
dma-coherent.c	drivers: dma-coherent: Fix typo in dma_mmap_from_coherent documentation	12 years ago
dma-contiguous.c	drivers: dma-contiguous: clean source code and prepare for device tree	12 years ago
dma-mapping.c	[media] dma-mapping: fix dma_common_get_sgtable() conditional compilation	12 years ago
driver.c	driver core: add #include <linux/sysfs.h> to core files.	12 years ago
firmware.c	…
firmware_class.c	firmware loader: fix pending_fw_head list corruption	12 years ago
hypervisor.c	…
init.c	…
isa.c	…
map.c	…
memory.c	ACPI and power management updates for 3.12-rc1	12 years ago
module.c	…
node.c	thp: account anon transparent huge pages into NR_ANON_PAGES	12 years ago
pinctrl.c	drivers: pinctrl sleep and idle states in the core	12 years ago
platform.c	driver-core: platform: convert bus code to use dev_groups	12 years ago
reservation.c	reservation: cross-device reservation support, v4	12 years ago
soc.c	mode_t whack-a-mole: ->is_visible() returns umode_t...	13 years ago
syscore.c	…
topology.c	cpu topology: remove stale arch_provides_topology_pointers and define_siblings_show_map/list()	12 years ago
transport_class.c	…