leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sunsu: Fix use after free in su_remove().

Browse Source 
Real serial port 'up' objects are statically allocated from an
array in the driver.  Keyboard and mouse ports, on the other
hand, are dynamically allocated.

Unfortunately, we free these dynamic 'up' objects before we unmap the
I/O registers.

Rearrange su_remove() so that this does not happen.

Noticed by Julia Lawall.

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2010-05-26 21:17:29 -07:00
parent 7c1f6afcf9
commit 9616ff434d
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/serial/sunsu.c
View File

@ -1500,20 +1500,25 @@ out_unmap:
static int __devexit su_remove(struct of_device *op)
{
struct uart_sunsu_port *up = dev_get_drvdata(&op->dev);
bool kbdms = false;
if (up->su_type == SU_PORT_MS ||
up->su_type == SU_PORT_KBD) {
up->su_type == SU_PORT_KBD)
kbdms = true;
if (kbdms) {
#ifdef CONFIG_SERIO
serio_unregister_port(&up->serio);
#endif
kfree(up);
} else if (up->port.type != PORT_UNKNOWN) {
} else if (up->port.type != PORT_UNKNOWN)
uart_remove_one_port(&sunsu_reg, &up->port);
}
if (up->port.membase)
of_iounmap(&op->resource[0], up->port.membase, up->reg_size);
if (kbdms)
kfree(up);
dev_set_drvdata(&op->dev, NULL);
return 0;