From: Konstantin Khlebnikov <khlebnikov@openvz.org>
To: linux-kernel@vger.kernel.org
Cc: Denis Kirjanov <kirjanov@gmail.com>, Borislav Petkov <bp@alien8.de>
Subject: [PATCH 12/12] edac: fix kernel panic on module unloading
Date: Fri, 14 Dec 2012 15:03:10 +0400 [thread overview]
Message-ID: <20121214110310.11019.21098.stgit@zurg> (raw)
In-Reply-To: <20121214110229.11019.63713.stgit@zurg>
This patch fixes use-after-free and double-free bugs in edac_mc_sysfs_exit().
mci_pdev has single reference and put_device() calls mc_attr_release() which
calls kfree(), thus following device_del() works with already released memory.
An another kfree() in edac_mc_sysfs_exit() releses the same memory again. Great.
Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
Cc: Denis Kirjanov <kirjanov@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
---
[ 2.707667] general protection fault: 0000 [#1] SMP
[ 2.707809] Modules linked in: sctp rfcomm bnep bluetooth fuse nfsd exportfs parport_pc parport powernow_k8 i2c_nforce2 pcspkr k8temp evbug edac_cor
e(-) kvm_amd kvm btrfs zlib_deflate libcrc32c ide_pci_generic ide_core ata_generic pata_acpi sata_nv [last unloaded: leds_pca9532]
[ 2.708369] CPU 0
[ 2.708369] Pid: 15179, comm: rmmod Tainted: P 3.7.0-rc8-next-20121211+ #595 Gigabyte Technology Co., Ltd. M52S-S3P/M52S-S3P
[ 2.708369] RIP: 0010:[<ffffffff812e58e6>] [<ffffffff812e58e6>] __list_add+0x26/0xd0
[ 2.708369] RSP: 0018:ffff88007a609da8 EFLAGS: 00010046
[ 2.708369] RAX: ffff880079883570 RBX: ffff88007a609df8 RCX: 0000000000000000
[ 2.708369] RDX: ffff880079883570 RSI: 6b6b6b6b6b6b6b6b RDI: ffff88007a609df8
[ 2.708369] RBP: ffff88007a609dc8 R08: 6b6b6b6b6b6b6b6b R09: 0000000000000000
[ 2.708369] R10: ffff8800798934b0 R11: 0000000000000000 R12: ffff880079883570
[ 2.708369] R13: 6b6b6b6b6b6b6b6b R14: 00007fc92d0d1090 R15: ffff880079883530
[ 2.708369] FS: 00007fc92b533700(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
[ 2.708369] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2.708369] CR2: 00007f1da5d61000 CR3: 000000007b28e000 CR4: 00000000000007f0
[ 2.708369] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2.708369] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 2.708369] Process rmmod (pid: 15179, threadinfo ffff88007a608000, task ffff8800798934b0)
[ 2.710227] Stack:
[ 2.710227] 0000000000000000 ffff880079883538 0000000000000246 ffff8800798934b0
[ 2.710227] ffff88007a609e48 ffffffff817f711b ffffffff8141fde1 ffffffff8141e180
[ 2.710227] ffff880079883570 ffffffff812d2e3b ffff88007a609df8 ffff88007a609df8
[ 2.710227] Call Trace:
[ 2.710227] [<ffffffff817f711b>] mutex_lock_nested+0xfb/0x320
[ 2.710227] [<ffffffff8141fde1>] ? device_release_driver+0x21/0x40
[ 2.710227] [<ffffffff8141e180>] ? bus_get_device_klist+0x10/0x10
[ 2.710227] [<ffffffff812d2e3b>] ? kobject_put+0x2b/0x60
[ 2.710227] [<ffffffff8141fde1>] device_release_driver+0x21/0x40
[ 2.710227] [<ffffffff8141f621>] bus_remove_device+0xf1/0x140
[ 2.710227] [<ffffffff8141cdd7>] device_del+0x127/0x1b0
[ 2.710227] [<ffffffffa0276794>] edac_mc_sysfs_exit+0x1c/0x2f [edac_core]
[ 2.710227] [<ffffffffa02767d8>] edac_exit+0x31/0x33 [edac_core]
[ 2.710227] [<ffffffff810a0ce3>] sys_delete_module+0x163/0x280
[ 2.710227] [<ffffffff812ddc34>] ? lockdep_sys_exit_thunk+0x35/0x67
[ 2.710227] [<ffffffff812ddbbe>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[ 2.710227] [<ffffffff81801a12>] system_call_fastpath+0x16/0x1b
[ 2.710227] Code: 00 00 00 00 00 55 48 89 e5 48 83 ec 20 48 89 5d e8 4c 89 65 f0 48 89 fb 4c 89 6d f8 4c 8b 42 08 49 89 f5 49 89 d4 49 39 f0 75 31 <4d> 8b 45 00 4d 39 c4 75 6f 4c 39 e3 74 45 4c 39 eb 74 40 49 89
[ 2.710227] RIP [<ffffffff812e58e6>] __list_add+0x26/0xd0
[ 2.710227] RSP <ffff88007a609da8>
---
drivers/edac/edac_mc_sysfs.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index de2df92..a3b0119 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -1159,8 +1159,7 @@ int __init edac_mc_sysfs_init(void)
void __exit edac_mc_sysfs_exit(void)
{
- put_device(mci_pdev);
device_del(mci_pdev);
+ put_device(mci_pdev);
edac_put_sysfs_subsys();
- kfree(mci_pdev);
}
next prev parent reply other threads:[~2012-12-14 11:03 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-12-14 11:02 [PATCH 01/12] tools/testing/modules: introduce test which loads/unloads random modules Konstantin Khlebnikov
2012-12-14 11:02 ` [PATCH 02/12] driver core: add debug-objects debug for device-drivers Konstantin Khlebnikov
2012-12-14 11:02 ` [PATCH 03/12] mISDN: fix race in timer canceling on module unloading Konstantin Khlebnikov
2012-12-14 18:16 ` David Miller
2012-12-14 11:02 ` [PATCH 04/12] pps: pps_parport: fix oops " Konstantin Khlebnikov
2012-12-14 11:02 ` [PATCH 05/12] staging: vme_pio2: " Konstantin Khlebnikov
2012-12-17 12:01 ` Martyn Welch
2012-12-14 11:02 ` [PATCH 06/12] media/rc: fix oops on unloading module rc-core Konstantin Khlebnikov
2012-12-14 11:02 ` [PATCH 07/12] stmmac: fix platform driver unregistering Konstantin Khlebnikov
2012-12-14 18:16 ` David Miller
2012-12-14 11:02 ` [PATCH 08/12] bonding: do not cancel works in bond_uninit() Konstantin Khlebnikov
2012-12-14 18:16 ` David Miller
2012-12-14 11:02 ` [PATCH 09/12] pps: fix device destruction ordering Konstantin Khlebnikov
2012-12-14 11:03 ` [PATCH 10/12] mac802154: fix destructon ordering for ieee802154 devices Konstantin Khlebnikov
2012-12-14 18:16 ` David Miller
2012-12-14 11:03 ` [PATCH 11/12] firmware/dmi-sysfs: fix sysfs warning on module unload Konstantin Khlebnikov
2012-12-14 11:03 ` Konstantin Khlebnikov [this message]
2012-12-14 11:26 ` [PATCH 12/12] edac: fix kernel panic on module unloading Alan Cox
2012-12-14 11:50 ` Borislav Petkov
2012-12-14 11:55 ` Konstantin Khlebnikov
2012-12-14 13:26 ` Alan Cox
2012-12-15 17:53 ` Borislav Petkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121214110310.11019.21098.stgit@zurg \
--to=khlebnikov@openvz.org \
--cc=bp@alien8.de \
--cc=kirjanov@gmail.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).