Commit f123db8e authored by Benson Leung's avatar Benson Leung Committed by Greg Kroah-Hartman

driver core : Fix use after free of dev->parent in device_shutdown

The put_device(dev) at the bottom of the loop of device_shutdown
may result in the dev being cleaned up. In device_create_release,
the dev is kfreed.

However, device_shutdown attempts to use the dev pointer again after
put_device by referring to dev->parent.

Copy the parent pointer instead to avoid this condition.

This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11.
See bug report : https://code.google.com/p/chromium/issues/detail?id=297842
This can easily be reproduced when shutting down with
hidraw devices that report battery condition.
Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse.
For example, with the magic mouse :
The dev in question is "hidraw0"
dev->parent is "magicmouse"

In the course of the shutdown for this device, the input event cleanup calls
a put on hidraw0, decrementing its reference count.
When we finally get to put_device(dev) in device_shutdown, kobject_cleanup
is called and device_create_release does kfree(dev).
dev->parent is no longer valid, and we may crash in
put_device(dev->parent).

This change should be applied on any kernel with this change :
d1c6c030

Cc: stable@vger.kernel.org
Signed-off-by: default avatarBenson Leung <bleung@chromium.org>
Reviewed-by: default avatarMing Lei <ming.lei@canonical.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 667b4102
...@@ -2017,7 +2017,7 @@ EXPORT_SYMBOL_GPL(device_move); ...@@ -2017,7 +2017,7 @@ EXPORT_SYMBOL_GPL(device_move);
*/ */
void device_shutdown(void) void device_shutdown(void)
{ {
struct device *dev; struct device *dev, *parent;
spin_lock(&devices_kset->list_lock); spin_lock(&devices_kset->list_lock);
/* /*
...@@ -2034,7 +2034,7 @@ void device_shutdown(void) ...@@ -2034,7 +2034,7 @@ void device_shutdown(void)
* prevent it from being freed because parent's * prevent it from being freed because parent's
* lock is to be held * lock is to be held
*/ */
get_device(dev->parent); parent = get_device(dev->parent);
get_device(dev); get_device(dev);
/* /*
* Make sure the device is off the kset list, in the * Make sure the device is off the kset list, in the
...@@ -2044,8 +2044,8 @@ void device_shutdown(void) ...@@ -2044,8 +2044,8 @@ void device_shutdown(void)
spin_unlock(&devices_kset->list_lock); spin_unlock(&devices_kset->list_lock);
/* hold lock to avoid race with probe/release */ /* hold lock to avoid race with probe/release */
if (dev->parent) if (parent)
device_lock(dev->parent); device_lock(parent);
device_lock(dev); device_lock(dev);
/* Don't allow any more runtime suspends */ /* Don't allow any more runtime suspends */
...@@ -2063,11 +2063,11 @@ void device_shutdown(void) ...@@ -2063,11 +2063,11 @@ void device_shutdown(void)
} }
device_unlock(dev); device_unlock(dev);
if (dev->parent) if (parent)
device_unlock(dev->parent); device_unlock(parent);
put_device(dev); put_device(dev);
put_device(dev->parent); put_device(parent);
spin_lock(&devices_kset->list_lock); spin_lock(&devices_kset->list_lock);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment