This is a note to let you know that I've just added the patch titled
EDAC: Fix kernel panic on module unloading
to the 3.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
edac-fix-kernel-panic-on-module-unloading.patch
and it can be found in the queue-3.7 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 311bd84247ee0bedae6cdfbfc5e2c3450f9decd1 Mon Sep 17 00:00:00 2001
From: Konstantin Khlebnikov <[email protected]>
Date: Fri, 14 Dec 2012 15:03:10 +0400
Subject: EDAC: Fix kernel panic on module unloading
From: Konstantin Khlebnikov <[email protected]>
commit 311bd84247ee0bedae6cdfbfc5e2c3450f9decd1 upstream.
This patch fixes use-after-free and double-free bugs in
edac_mc_sysfs_exit(). mci_pdev has single reference and put_device()
calls mc_attr_release() which calls kfree(). The following
device_del() works with already released memory. An another kfree() in
edac_mc_sysfs_exit() releses the same memory again. Great.
Signed-off-by: Konstantin Khlebnikov <[email protected]>
Cc: Denis Kirjanov <[email protected]>
Cc: Mauro Carvalho Chehab <[email protected]>
Link: http://lkml.kernel.org/r/20121214110310.11019.21098.stgit@zurg
Signed-off-by: Borislav Petkov <[email protected]>
[ a partial 3.7.y backport ]
Signed-off-by: Borislav Petkov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/edac/edac_mc_sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -1145,7 +1145,7 @@ int __init edac_mc_sysfs_init(void)
void __exit edac_mc_sysfs_exit(void)
{
- put_device(mci_pdev);
device_del(mci_pdev);
+ put_device(mci_pdev);
edac_put_sysfs_subsys();
}
Patches currently in stable-queue which might be from [email protected] are
queue-3.7/edac-fix-kernel-panic-on-module-unloading.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
