summaryrefslogtreecommitdiff
path: root/drivers/base
diff options
context:
space:
mode:
authorManeesh Soni <maneesh@in.ibm.com>2005-08-16 15:15:48 -0700
committerLinus Torvalds <torvalds@g5.osdl.org>2005-08-16 21:06:24 -0700
commit208f3d6175cb17772c5af202fe12373f90894ff4 (patch)
tree86265a0aa2a8007e181e9edb279b2fab81b812ee /drivers/base
parent12aaa0855b39b5464db953fedf399fa91ee365ed (diff)
[PATCH] Driver core: potentially fix use after free in class_device_attr_show
This moves the code to free devt_attr from class_device_del() to class_dev_release() which is called after the last reference to the corresponding kobject() is gone. This allows us to keep the devt_attr alive while the corresponding sysfs file is open. Signed-off-by: Maneesh Soni <maneesh@in.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/base')
-rw-r--r--drivers/base/class.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/base/class.c b/drivers/base/class.c
index 479c12570881..0154a1623b21 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -299,6 +299,11 @@ static void class_dev_release(struct kobject * kobj)
pr_debug("device class '%s': release.\n", cd->class_id);
+ if (cd->devt_attr) {
+ kfree(cd->devt_attr);
+ cd->devt_attr = NULL;
+ }
+
if (cls->release)
cls->release(cd);
else {
@@ -591,11 +596,8 @@ void class_device_del(struct class_device *class_dev)
if (class_dev->dev)
sysfs_remove_link(&class_dev->kobj, "device");
- if (class_dev->devt_attr) {
+ if (class_dev->devt_attr)
class_device_remove_file(class_dev, class_dev->devt_attr);
- kfree(class_dev->devt_attr);
- class_dev->devt_attr = NULL;
- }
class_device_remove_attrs(class_dev);
kobject_hotplug(&class_dev->kobj, KOBJ_REMOVE);