tree 86265a0aa2a8007e181e9edb279b2fab81b812ee
parent 12aaa0855b39b5464db953fedf399fa91ee365ed
author Maneesh Soni <[EMAIL PROTECTED]> Wed, 17 Aug 2005 05:15:48 -0700
committer Linus Torvalds <[EMAIL PROTECTED]> Wed, 17 Aug 2005 11:06:24 -0700

[PATCH] Driver core: potentially fix use after free in class_device_attr_show

This moves the code to free devt_attr from class_device_del() to
class_dev_release() which is called after the last reference to the
corresponding kobject() is gone.

This allows us to keep the devt_attr alive while the corresponding
sysfs file is open.

Signed-off-by: Maneesh Soni <[EMAIL PROTECTED]>
Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>

 drivers/base/class.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/base/class.c b/drivers/base/class.c
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -299,6 +299,11 @@ static void class_dev_release(struct kob
 
        pr_debug("device class '%s': release.\n", cd->class_id);
 
+       if (cd->devt_attr) {
+               kfree(cd->devt_attr);
+               cd->devt_attr = NULL;
+       }
+
        if (cls->release)
                cls->release(cd);
        else {
@@ -591,11 +596,8 @@ void class_device_del(struct class_devic
 
        if (class_dev->dev)
                sysfs_remove_link(&class_dev->kobj, "device");
-       if (class_dev->devt_attr) {
+       if (class_dev->devt_attr)
                class_device_remove_file(class_dev, class_dev->devt_attr);
-               kfree(class_dev->devt_attr);
-               class_dev->devt_attr = NULL;
-       }
        class_device_remove_attrs(class_dev);
 
        kobject_hotplug(&class_dev->kobj, KOBJ_REMOVE);
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to