mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-24 17:23:25 -05:00
Code Activity

PM / devfreq: fix use after free in devfreq_remove_device

Browse source 
In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
This commit is contained in:
Axel Lin 2011-11-14 23:31:29 +01:00 • committed by Rafael J. Wysocki
parent bc9f54498e
commit 9f3bdd4f93
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/devfreq/devfreq.c
View file

@ -418,10 +418,14 @@ out:
*/
int devfreq_remove_device(struct devfreq *devfreq)
{
bool central_polling;
if (!devfreq)
return -EINVAL;
if (!devfreq->governor->no_central_polling) {
central_polling = !devfreq->governor->no_central_polling;
if (central_polling) {
mutex_lock(&devfreq_list_lock);
while (wait_remove_device == devfreq) {
mutex_unlock(&devfreq_list_lock);
@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
mutex_lock(&devfreq->lock);
_remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
if (!devfreq->governor->no_central_polling)
if (central_polling)
mutex_unlock(&devfreq_list_lock);
return 0;