releases/4.4.92/stm-class-fix-a-use-after-free.patch

   1 From fd085bb1766d6a598f53af2308374a546a49775a Mon Sep 17 00:00:00 2001
   2 From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
   3 Date: Tue, 19 Sep 2017 18:47:40 +0300
   4 Subject: stm class: Fix a use-after-free
   5
   6 From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
   7
   8 commit fd085bb1766d6a598f53af2308374a546a49775a upstream.
   9
  10 For reasons unknown, the stm_source removal path uses device_destroy()
  11 to kill the underlying device object. Because device_destroy() uses
  12 devt to look for the device to destroy and the fact that stm_source
  13 devices don't have one (or all have the same one), it just picks the
  14 first device in the class, which may well be the wrong one.
  15
  16 That is, loading stm_console and stm_heartbeat and then removing both
  17 will die in dereferencing a freed object.
  18
  19 Since this should have been device_unregister() in the first place,
  20 use it instead of device_destroy().
  21
  22 Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
  23 Fixes: 7bd1d4093c2 ("stm class: Introduce an abstraction for System Trace Module devices")
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25
  26 ---
  27  drivers/hwtracing/stm/core.c |    2 +-
  28  1 file changed, 1 insertion(+), 1 deletion(-)
  29
  30 --- a/drivers/hwtracing/stm/core.c
  31 +++ b/drivers/hwtracing/stm/core.c
  32 @@ -952,7 +952,7 @@ void stm_source_unregister_device(struct
  33
  34         stm_source_link_drop(src);
  35
  36 -       device_destroy(&stm_source_class, src->dev.devt);
  37 +       device_unregister(&src->dev);
  38  }
  39  EXPORT_SYMBOL_GPL(stm_source_unregister_device);
  40