OSDN Git Service

stm class: Fix a use-after-free
authorAlexander Shishkin <alexander.shishkin@linux.intel.com>
Tue, 19 Sep 2017 15:47:40 +0000 (18:47 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 12 Oct 2017 09:51:24 +0000 (11:51 +0200)
commit3ff8bc813b1301ee1395b4629b5136559e3fc6ba
treef7eaa2cf60aa67eb8e5ae378a09ef7390b3cbb1b
parentc541aaad4ac7830c4ee3d14ed984c423b9e7e479
stm class: Fix a use-after-free

commit fd085bb1766d6a598f53af2308374a546a49775a upstream.

For reasons unknown, the stm_source removal path uses device_destroy()
to kill the underlying device object. Because device_destroy() uses
devt to look for the device to destroy and the fact that stm_source
devices don't have one (or all have the same one), it just picks the
first device in the class, which may well be the wrong one.

That is, loading stm_console and stm_heartbeat and then removing both
will die in dereferencing a freed object.

Since this should have been device_unregister() in the first place,
use it instead of device_destroy().

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/hwtracing/stm/core.c