Re: [OOPS] linux-2.6.7-bk20: possible use-after-free in platform_device_unregister()

[Dmitry Torokhov]

On Saturday 10 July 2004 01:31 pm, Denis Vlasenko wrote:
> void platform_device_unregister(struct platform_device * pdev)
> {
> ? ? ? ? int i;
> 
> ? ? ? ? if (pdev) {
> ? ? ? ? ? ? ? ? device_unregister(&pdev->dev);
>

Here depca_platform_release kicks in and frees platform device structure.
platform_device_unregister should save pointer to resources. 
 
> ? ? ? ? ? ? ? ? for (i = 0; i < pdev->num_resources; i++) {
> ? ? ? ? ? ? ? ? ? ? ? ? struct resource *r = &pdev->resource[i];
> ===> ? ? ? ? ? ? ? ? ? ?if (r->flags & (IORESOURCE_MEM|IORESOURCE_IO))
> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? release_resource(r);
> ? ? ? ? ? ? ? ? }
> ? ? ? ? }
> }
> 

Does the following help (hopefully it will apply - I have just a tad
different tree):

===== drivers/base/platform.c 1.21 vs edited =====
--- 1.21/drivers/base/platform.c	2004-07-04 19:56:37 -05:00
+++ edited/drivers/base/platform.c	2004-07-10 14:44:51 -05:00
@@ -143,13 +143,15 @@
  */
 void platform_device_unregister(struct platform_device * pdev)
 {
-	int i;
-
 	if (pdev) {
+		int i, num_resources = pdev->num_resources;
+		struct resource *r, *resources = pdev->resource;
+
+		/* this call may free pdev, that's why we saved resource data */
 		device_unregister(&pdev->dev);
 
-		for (i = 0; i < pdev->num_resources; i++) {
-			struct resource *r = &pdev->resource[i];
+		for (i = 0; i < num_resources; i++) {
+			r = &resources[i];
 			if (r->flags & (IORESOURCE_MEM|IORESOURCE_IO))
 				release_resource(r);
 		}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/