[patch 1/7] Driver core: potentially fix use after free in class_device_attr_show

[Greg Kroah-Hartman]

From: Maneesh Soni <maneesh@xxxxxxxxxx>

o moves the code to free devt_attr from class_device_del() to
  class_dev_release() which is called after the last reference to the
  corresponding kobject() is gone. This allows to keep the devt_attr
  alive while the corresponding sysfs file is open.

Signed-off-by: Maneesh Soni <maneesh@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxx>

---
 drivers/base/class.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

--- gregkh-2.6.orig/drivers/base/class.c	2005-08-16 14:51:44.000000000 -0700
+++ gregkh-2.6/drivers/base/class.c	2005-08-16 14:56:58.000000000 -0700
@@ -299,6 +299,11 @@ static void class_dev_release(struct kob
 
 	pr_debug("device class '%s': release.\n", cd->class_id);
 
+	if (cd->devt_attr) {
+		kfree(cd->devt_attr);
+		cd->devt_attr = NULL;
+	}
+
 	if (cls->release)
 		cls->release(cd);
 	else {
@@ -591,11 +596,8 @@ void class_device_del(struct class_devic
 
 	if (class_dev->dev)
 		sysfs_remove_link(&class_dev->kobj, "device");
-	if (class_dev->devt_attr) {
+	if (class_dev->devt_attr)
 		class_device_remove_file(class_dev, class_dev->devt_attr);
-		kfree(class_dev->devt_attr);
-		class_dev->devt_attr = NULL;
-	}
 	class_device_remove_attrs(class_dev);
 
 	kobject_hotplug(&class_dev->kobj, KOBJ_REMOVE);

--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/