TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH] driver-core: don't free devt_attr till the device is released

Browse Source 
Currently, devt_attr for the "dev" file is freed immediately on device
removal, but if the "dev" sysfs file is open when a device is removed,
sysfs will access its attribute structure for further access including
close resulting in jumping to garbled address.  Fix it by postponing
freeing devt_attr to device release time.

Note that devt_attr for class_device is already freed on release.

This bug is reported by Chris Rankin as bugzilla bug#8198.

Signed-off-by: Tejun Heo <htejun@gmail.com>
Cc: Chris Rankin <rankincj@yahoo.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Tejun Heo
2007-05-10 16:45:17 +02:00
committed by Chris Wright
parent ef229b87b8
commit 0b7da0500b
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/base/core.c
+4 -3
View File
@@ -93,6 +93,9 @@ static void device_release(struct kobject * kobj)
{
struct device * dev = to_dev(kobj);
kfree(dev->devt_attr);
dev->devt_attr = NULL;
if (dev->release)
dev->release(dev);
else if (dev->class && dev->class->dev_release)
@@ -650,10 +653,8 @@ void device_del(struct device * dev)
if (parent)
klist_del(&dev->knode_parent);
if (dev->devt_attr) {
if (dev->devt_attr)
device_remove_file(dev, dev->devt_attr);
kfree(dev->devt_attr);
}
if (dev->class) {
sysfs_remove_link(&dev->kobj, "subsystem");
/* If this is not a "fake" compatible device, remove the