Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754240AbbG2XmP (ORCPT ); Wed, 29 Jul 2015 19:42:15 -0400 Received: from mail-qk0-f178.google.com ([209.85.220.178]:33440 "EHLO mail-qk0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753819AbbG2XmN (ORCPT ); Wed, 29 Jul 2015 19:42:13 -0400 MIME-Version: 1.0 In-Reply-To: <20150729174619.GC23178@dtor-ws> References: <1438042590-17719-1-git-send-email-k.kozlowski@samsung.com> <20150729174619.GC23178@dtor-ws> Date: Thu, 30 Jul 2015 08:42:12 +0900 X-Google-Sender-Auth: IjEWhkMGtQI9iXAEuACvw8XY6HA Message-ID: Subject: Re: [PATCH] HID: hid-input: Fix accessing freed memory during driver unbind From: Krzysztof Kozlowski To: Dmitry Torokhov Cc: Jiri Kosina , Krzysztof Kozlowski , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, sre@kernel.org, linux-pm@vger.kernel.org, "H.J. Lu" , stable@vger.kernel.org Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1867 Lines: 49 2015-07-30 2:46 GMT+09:00 Dmitry Torokhov : > On Wed, Jul 29, 2015 at 03:07:04PM +0200, Jiri Kosina wrote: >> On Tue, 28 Jul 2015, Krzysztof Kozlowski wrote: >> >> > During unbinding the driver was dereferencing a pointer to memory >> > already freed by power_supply_unregister(). >> > >> > Driver was freeing its internal description of battery through pointers >> > stored in power_supply structure. However, because the core owns the >> > power supply instance, after calling power_supply_unregister() the >> > driver cannot access these members. >> > >> > Fix this by using resource-managed allocations so internal data will be >> > freed by pointers stored in resource-managed core. >> > >> > Signed-off-by: Krzysztof Kozlowski >> > Reported-by: H.J. Lu >> > Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core") >> > Cc: >> >> Applied to for-4.2/upstream-fixes, thanks. > > Wait, what guarantees do we have that this is only called in probe() > paths? Don't we allow hid_hw_start() be deferred to open() calls? Indeed, this may be called in other contexts. But this should not introduce errors except not reclaimable memory (till remove() happens). > In general we need to be careful with devm* conversions in core code. > Another and less intrusive fix would be: char *name = dev->battery->desc->name; struct power_supply_desc *psy_desc = dev->battery->desc; power_supply_unregister(dev->battery); kfree(name); kfree(psy_desc); How about this? Best regards, Krzysztof -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/