* Re: misc: hpilo: Fix use-after-free in ilo_open * offset from mmio_vaddr for enabling doorbell interrupts */ Static int ilo_probe(struct pci_dev -810,6 +820,7 static int ilo_probe(struct pci_dev *pdev,ĭiff -git a/drivers/misc/hpilo.h b/drivers/misc/hpilo.h See acpi_pci_link_free_irq called from acpi_pci_irq_disable. * the interrupt link is disabled in ACPI since it is not refcounted by rmmod hpilo, the controller stops working. * two functions with interrupt lines connected to a single pin. * pci_disable_device(pdev) used to be here. If -748,27 +778,7 static void ilo_remove(struct pci_dev *pdev) Return -629,6 +658,7 static int ilo_open(struct inode *ip, struct file *fp) Int -558,6 +586,7 static int ilo_close(struct inode *ip, struct file *fp) Static int ilo_close(struct inode *ip, struct file *fp) + * the interrupt link is disabled in ACPI since it is not refcounted + * two functions with interrupt lines connected to a single pin. + * pci_disable_device(pdev) used to be here. + struct ilo_hwinfo *ilo_hw = container_of(kref, struct ilo_hwinfo, refcnt) +static void ilo_delete(struct kref *kref) To free the "ilo_hwinfo" structure after the device is close()d. Therefore, add a refcount check to ilo_remove() function
The ilo_remove() function, which may lead to Use-After-Free. This is a race condition between ilo_open() function and To: matt.hsiao +Cc: arnd, gregkh, linux-kernel, Yoochan LeeĪ race condition may occur if the user physically removes the ` (4 more replies) 0 siblings, 5 replies 14+ messages in thread Misc: hpilo: Fix use-after-free in ilo_open LKML Archive on help / color / mirror / Atom feed * misc: hpilo: Fix use-after-free in ilo_open 5:53 Yoochan Lee
0 kommentar(er)
