summaryrefslogtreecommitdiffstats
path: root/drivers/hwtracing
diff options
context:
space:
mode:
authorAlexander Shishkin <alexander.shishkin@linux.intel.com>2017-09-19 18:47:40 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-09-22 10:28:00 +0200
commitfd085bb1766d6a598f53af2308374a546a49775a (patch)
tree9c18f05982c5ca1bf03aa706c4d1a96d33d3797d /drivers/hwtracing
parentaad8d097c9224be264939fc6c02a5570ea094f60 (diff)
downloadlinux-stable-fd085bb1766d6a598f53af2308374a546a49775a.tar.gz
linux-stable-fd085bb1766d6a598f53af2308374a546a49775a.tar.bz2
linux-stable-fd085bb1766d6a598f53af2308374a546a49775a.zip
stm class: Fix a use-after-free
For reasons unknown, the stm_source removal path uses device_destroy() to kill the underlying device object. Because device_destroy() uses devt to look for the device to destroy and the fact that stm_source devices don't have one (or all have the same one), it just picks the first device in the class, which may well be the wrong one. That is, loading stm_console and stm_heartbeat and then removing both will die in dereferencing a freed object. Since this should have been device_unregister() in the first place, use it instead of device_destroy(). Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices") Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/hwtracing')
-rw-r--r--drivers/hwtracing/stm/core.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 9414900575d8..f129869e05a9 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1119,7 +1119,7 @@ void stm_source_unregister_device(struct stm_source_data *data)
stm_source_link_drop(src);
- device_destroy(&stm_source_class, src->dev.devt);
+ device_unregister(&src->dev);
}
EXPORT_SYMBOL_GPL(stm_source_unregister_device);