提交 557a701c 编写于 作者: T Thomas Renninger 提交者: Dave Jones

[CPUFREQ] Fix use after free of struct powernow_k8_data

Easy fix for a regression introduced in 2.6.31.

On managed CPUs the cpufreq.c core will call driver->exit(cpu) on the
managed cpus and powernow_k8 will free the core's data.

Later driver->get(cpu) function might get called trying to read out the
current freq of a managed cpu and the NULL pointer check does not work on
the freed object -> better set it to NULL.

->get() is unsigned and must return 0 as invalid frequency.

Reference:
http://bugzilla.kernel.org/show_bug.cgi?id=14391Signed-off-by: NThomas Renninger <trenn@suse.de>
Tested-by: NMichal Schmidt <mschmidt@redhat.com>
CC: stable@kernel.org
Signed-off-by: NDave Jones <davej@redhat.com>
上级 292e0041
...@@ -1356,6 +1356,7 @@ static int __devexit powernowk8_cpu_exit(struct cpufreq_policy *pol) ...@@ -1356,6 +1356,7 @@ static int __devexit powernowk8_cpu_exit(struct cpufreq_policy *pol)
kfree(data->powernow_table); kfree(data->powernow_table);
kfree(data); kfree(data);
per_cpu(powernow_data, pol->cpu) = NULL;
return 0; return 0;
} }
...@@ -1375,7 +1376,7 @@ static unsigned int powernowk8_get(unsigned int cpu) ...@@ -1375,7 +1376,7 @@ static unsigned int powernowk8_get(unsigned int cpu)
int err; int err;
if (!data) if (!data)
return -EINVAL; return 0;
smp_call_function_single(cpu, query_values_on_cpu, &err, true); smp_call_function_single(cpu, query_values_on_cpu, &err, true);
if (err) if (err)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册