Skip to contentSkip to conversation

devfreq: fix use after free in devfreq_remove_device

PATCH New Axel Lin 1 participant 2 messages Nov 10, 2011 Device frequency (devfreq)

lore
Share & tools
lore

Axel Lin

author
#0 lore raw

PATCH 1/2 devfreq: fix use after free in devfreq_remove_device

In devfreq_remove_device, calling _remove_devfreq will also free devfreq. Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.

Signed-off-by Axel Lin <[email protected]>
---
 drivers/devfreq/devfreq.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)
drivers/devfreq/devfreq.c +6 -2
index d065925..59d24e9 100644
@@ -418,10 +418,14 @@ out:
  */
 int devfreq_remove_device(struct devfreq *devfreq)
 {
+	bool central_polling;
+
 	if (!devfreq)
 		return -EINVAL;
 
-	if (!devfreq->governor->no_central_polling) {
+	central_polling = !devfreq->governor->no_central_polling;
+
+	if (central_polling) {
 		mutex_lock(&devfreq_list_lock);
 		while (wait_remove_device == devfreq) {
 			mutex_unlock(&devfreq_list_lock);

@@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
 	mutex_lock(&devfreq->lock);
 	_remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
 
-	if (!devfreq->governor->no_central_polling)
+	if (central_polling)
 		mutex_unlock(&devfreq_list_lock);
 
 	return 0;
Signature · 1 line
1.7.5.4
author
#1 lore raw

PATCH 2/2 devfreq: separate error paths from successful path

I think this change improves readability.

Signed-off-by Axel Lin <[email protected]>
---
 drivers/devfreq/devfreq.c |   15 +++++++--------
 1 files changed, 7 insertions(+), 8 deletions(-)
drivers/devfreq/devfreq.c +7 -8
index 59d24e9..c189b82 100644
@@ -347,7 +347,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
 		if (!IS_ERR(devfreq)) {
 			dev_err(dev, "%s: Unable to create devfreq for the device. It already has one.\n", __func__);
 			err = -EINVAL;
-			goto out;
+			goto err_out;
 		}
 	}
 

@@ -356,7 +356,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
 		dev_err(dev, "%s: Unable to create devfreq for the device\n",
 			__func__);
 		err = -ENOMEM;
-		goto out;
+		goto err_out;
 	}
 
 	mutex_init(&devfreq->lock);

@@ -399,17 +399,16 @@ struct devfreq *devfreq_add_device(struct device *dev,
 				   devfreq->next_polling);
 	}
 	mutex_unlock(&devfreq_list_lock);
-	goto out;
+out:
+	return devfreq;
+
 err_init:
 	device_unregister(&devfreq->dev);
 err_dev:
 	mutex_unlock(&devfreq->lock);
 	kfree(devfreq);
-out:
-	if (err)
-		return ERR_PTR(err);
-	else
-		return devfreq;
+err_out:
+	return ERR_PTR(err);
 }
 
 /**
Signature · 1 line
1.7.5.4