• Benson Leung's avatar
    driver core : Fix use after free of dev->parent in device_shutdown · f123db8e
    Benson Leung authored
    The put_device(dev) at the bottom of the loop of device_shutdown
    may result in the dev being cleaned up. In device_create_release,
    the dev is kfreed.
    
    However, device_shutdown attempts to use the dev pointer again after
    put_device by referring to dev->parent.
    
    Copy the parent pointer instead to avoid this condition.
    
    This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11.
    See bug report : https://code.google.com/p/chromium/issues/detail?id=297842
    This can easily be reproduced when shutting down with
    hidraw devices that report battery condition.
    Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse.
    For example, with the magic mouse :
    The dev in question is "hidraw0"
    dev->parent is "magicmouse"
    
    In the course of the shutdown for this device, the input event cleanup calls
    a put on hidraw0, decrementing its reference count.
    When we finally get to put_device(dev) in device_shutdown, kobject_cleanup
    is called and device_create_release does kfree(dev).
    dev->parent is no longer valid, and we may crash in
    put_device(dev->parent).
    
    This change should be applied on any kernel with this change :
    d1c6c030
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarBenson Leung <bleung@chromium.org>
    Reviewed-by: default avatarMing Lei <ming.lei@canonical.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    f123db8e
core.c 56.6 KB