linux/drivers/base
Benson Leung f123db8e9d driver core : Fix use after free of dev->parent in device_shutdown
The put_device(dev) at the bottom of the loop of device_shutdown
may result in the dev being cleaned up. In device_create_release,
the dev is kfreed.

However, device_shutdown attempts to use the dev pointer again after
put_device by referring to dev->parent.

Copy the parent pointer instead to avoid this condition.

This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11.
See bug report : https://code.google.com/p/chromium/issues/detail?id=297842
This can easily be reproduced when shutting down with
hidraw devices that report battery condition.
Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse.
For example, with the magic mouse :
The dev in question is "hidraw0"
dev->parent is "magicmouse"

In the course of the shutdown for this device, the input event cleanup calls
a put on hidraw0, decrementing its reference count.
When we finally get to put_device(dev) in device_shutdown, kobject_cleanup
is called and device_create_release does kfree(dev).
dev->parent is no longer valid, and we may crash in
put_device(dev->parent).

This change should be applied on any kernel with this change :
d1c6c030fc

Cc: stable@vger.kernel.org
Signed-off-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26 14:46:11 -07:00
..
power ACPI and power management updates for 3.12-rc1 2013-09-03 15:59:39 -07:00
regmap Driver core patches for 3.12-rc1 2013-09-03 11:37:15 -07:00
attribute_container.c drivers: avoid format string in dev_set_name 2013-07-03 16:07:41 -07:00
base.h driver core: bus_type: add drv_groups 2013-08-12 15:33:31 -07:00
bus.c driver core: add #include <linux/sysfs.h> to core files. 2013-08-27 10:24:15 -07:00
class.c sysfs.h: remove attr_name() macro 2013-08-22 10:25:34 -07:00
core.c driver core : Fix use after free of dev->parent in device_shutdown 2013-09-26 14:46:11 -07:00
cpu.c ACPI and power management updates for 3.12-rc1 2013-09-03 15:59:39 -07:00
dd.c PM / Runtime: Idle devices asynchronously after probe|release 2013-04-11 12:42:52 -07:00
devres.c Linux 3.9-rc3 2013-03-17 19:40:50 -07:00
devtmpfs.c driver core: handle user namespaces properly with the uid/gid devtmpfs change 2013-04-11 11:43:29 -07:00
dma-buf.c dma-buf: Expose buffer size to userspace (v2) 2013-09-10 11:36:45 +05:30
dma-coherent.c drivers: dma-coherent: Fix typo in dma_mmap_from_coherent documentation 2012-10-23 14:05:32 +02:00
dma-contiguous.c drivers: dma-contiguous: clean source code and prepare for device tree 2013-08-27 09:18:29 +02:00
dma-mapping.c [media] dma-mapping: fix dma_common_get_sgtable() conditional compilation 2012-11-27 09:42:31 -02:00
driver.c driver core: add #include <linux/sysfs.h> to core files. 2013-08-27 10:24:15 -07:00
firmware_class.c firmware loader: fix pending_fw_head list corruption 2013-08-30 12:04:27 -07:00
firmware.c
hypervisor.c drivers/base: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required. 2011-10-31 19:31:38 -04:00
init.c driver-core: implement 'sysdev' functionality for regular devices and buses 2011-12-14 14:29:38 -08:00
isa.c dma-mapping: replace all DMA_24BIT_MASK macro with DMA_BIT_MASK(24) 2009-04-07 08:31:12 -07:00
Kconfig Merge remote-tracking branch 'dma-public/for-v3.12-cma-dma' into for-next 2013-07-15 11:13:54 +02:00
Makefile Merge remote-tracking branch 'origin/next' into kvm-ppc-next 2013-08-29 00:41:59 +02:00
map.c
memory.c ACPI and power management updates for 3.12-rc1 2013-09-03 15:59:39 -07:00
module.c driver core: module.c: Use kasprintf 2010-05-21 09:37:29 -07:00
node.c thp: account anon transparent huge pages into NR_ANON_PAGES 2013-09-12 15:38:03 -07:00
pinctrl.c drivers: pinctrl sleep and idle states in the core 2013-06-16 11:56:52 +02:00
platform.c driver-core: platform: convert bus code to use dev_groups 2013-08-23 14:43:44 -07:00
reservation.c reservation: cross-device reservation support, v4 2013-06-28 12:02:15 +10:00
soc.c mode_t whack-a-mole: ->is_visible() returns umode_t... 2012-05-29 23:28:42 -04:00
syscore.c PM: Reintroduce dropped call to check_wakeup_irqs 2011-07-11 10:51:49 +02:00
topology.c cpu topology: remove stale arch_provides_topology_pointers and define_siblings_show_map/list() 2013-07-29 13:12:45 -07:00
transport_class.c drivers/base: transport_class explicitly requires EXPORT_SYMBOL 2011-10-31 19:31:15 -04:00