[PATCH] stm class: drop the source link after the source device is gone

[Yu Zhang]

stm_source_unregister_device() drops the link of the source and only
then unregisters its device. The stm_source_link sysfs attribute is
still reachable in between, so a concurrent write to it re-links the
source: it ends up on the stm device's link list with src->link set and
the source's link() callback armed, after which device_unregister()
frees it and the source module is unloaded. The next unlink walk in
stm_unregister_device() then touches the freed source, the stm device
keeps a reference that is never dropped, and a source like
stm_heartbeat has its hrtimer fire in freed module memory.

Delete the device first, which drains the sysfs attribute, then drop
the link and release the device.

Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yu Zhang <yuz08559@xxxxxxxxx>
---
 drivers/hwtracing/stm/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 5fbea4e..64a9eb1 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -1287,9 +1287,9 @@ void stm_source_unregister_device(struct stm_source_data *data)
 {
 	struct stm_source_device *src = data->src;
 
+	device_del(&src->dev);
 	stm_source_link_drop(src);
-
-	device_unregister(&src->dev);
+	put_device(&src->dev);
 }
 EXPORT_SYMBOL_GPL(stm_source_unregister_device);
 
-- 
2.43.0