1. 14 11月, 2016 24 次提交
  2. 13 11月, 2016 1 次提交
  3. 12 11月, 2016 7 次提交
  4. 11 11月, 2016 7 次提交
  5. 10 11月, 2016 1 次提交
    • J
      ppdev: fix double-free of pp->pdev->name · b13d1433
      Jann Horn 提交于
      free_pardevice() is called by parport_unregister_device() and already frees
      pp->pdev->name, don't try to do it again.
      
      This bug causes kernel crashes.
      
      I found and verified this with KASAN and some added pr_emerg()s:
      
      [   60.316568] pp_release: pp->pdev->name == ffff88039cb264c0
      [   60.316692] free_pardevice: freeing par_dev->name at ffff88039cb264c0
      [   60.316706] pp_release: kfree(ffff88039cb264c0)
      [   60.316714] ==========================================================
      [   60.316722] BUG: Double free or freeing an invalid pointer
      [   60.316731] Unexpected shadow byte: 0xFB
      [   60.316801] Object at ffff88039cb264c0, in cache kmalloc-32 size: 32
      [   60.316813] Allocated:
      [   60.316824] PID = 1695
      [   60.316869] Freed:
      [   60.316880] PID = 1695
      [   60.316935] ==========================================================
      Signed-off-by: NJann Horn <jann@thejh.net>
      Acked-by: NSudip Mukherjee <sudipm.mukherjee@gmail.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b13d1433