提交 6a88231f 编写于 作者: M Max Asbock 提交者: Linus Torvalds

[PATCH] ibmasm: use after free fix

The kobject_put() can free the memory at *cmd, but cmd->lock points to a
persistent lock that is not freed with cmd.
Signed-off-by: NMax Asbock <masbock@us.ibm.com>
Cc: Vernon Mauery <vernux@us.ibm.com>
Cc: Srihari Vijayaraghavan <sriharivijayaraghavan@yahoo.com.au>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
上级 a6bf5270
......@@ -101,10 +101,11 @@ struct command {
static inline void command_put(struct command *cmd)
{
unsigned long flags;
spinlock_t *lock = cmd->lock;
spin_lock_irqsave(cmd->lock, flags);
spin_lock_irqsave(lock, flags);
kobject_put(&cmd->kobj);
spin_unlock_irqrestore(cmd->lock, flags);
spin_unlock_irqrestore(lock, flags);
}
static inline void command_get(struct command *cmd)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册