Skip to contentSkip to conversation

intel_cacheinfo: fix use-after-free cache_kobject

PATCH Applied Akinobu Mita 2 participants 2 messages Jul 15, 2008 – Jul 18, 2008 x86

lore
Share & tools
lore

Akinobu Mita

author
#0 lore raw

PATCH 1/1 intel_cacheinfo: fix use-after-free cache_kobject

This avoids calling kobject_uevent() with cache_kobject that has already been deallocated in an error path.

Signed-off-by Akinobu Mita <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Ingo Molnar <[email protected]>
Cc "H. Peter Anvin" <[email protected]>
---
 arch/x86/kernel/cpu/intel_cacheinfo.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
arch/x86/kernel/cpu/intel_cacheinfo.c +3 -4
Index: 2.6-mmotm/arch/x86/kernel/cpu/intel_cacheinfo.c
===================================================================
@@ -780,15 +780,14 @@ static int __cpuinit cache_add_dev(struc
 			}
 			kobject_put(per_cpu(cache_kobject, cpu));
 			cpuid4_cache_sysfs_exit(cpu);
-			break;
+			return retval;
 		}
 		kobject_uevent(&(this_object->kobj), KOBJ_ADD);
 	}
-	if (!retval)
-		cpu_set(cpu, cache_dev_map);
+	cpu_set(cpu, cache_dev_map);
 
 	kobject_uevent(per_cpu(cache_kobject, cpu), KOBJ_ADD);
-	return retval;
+	return 0;
 }
 
 static void __cpuinit cache_remove_dev(struct sys_device * sys_dev)
Applied
#1 lore raw
Quoted 2 lines · Akinobu Mita

This avoids calling kobject_uevent() with cache_kobject that has already been deallocated in an error path.

applied to tip/x86/urgent, thanks.

Ingo