mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-05 10:29:37 +00:00
stm class: Lose the protocol driver when dropping its reference
Commitc7fd62bc69
("stm class: Introduce framing protocol drivers") forgot to tear down the link between an stm device and its protocol driver when policy is removed. This leads to an invalid pointer reference if one tries to write to an stm device after the policy has been removed and the protocol driver module unloaded, leading to the below splat: > BUG: unable to handle page fault for address: ffffffffc0737068 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 3d780f067 P4D 3d780f067 PUD 3d7811067 PMD 492781067 PTE 0 > Oops: 0000 [#1] SMP NOPTI > CPU: 1 PID: 26122 Comm: cat Not tainted 5.4.0-rc5+ #1 > RIP: 0010:stm_output_free+0x40/0xc0 [stm_core] > Call Trace: > stm_char_release+0x3e/0x70 [stm_core] > __fput+0xc6/0x260 > ____fput+0xe/0x10 > task_work_run+0x9d/0xc0 > exit_to_usermode_loop+0x103/0x110 > do_syscall_64+0x19d/0x1e0 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix this by tearing down the link from an stm device to its protocol driver when the policy involving that driver is removed. Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> Fixes:c7fd62bc69
("stm class: Introduce framing protocol drivers") Reported-by: Ammy Yi <ammy.yi@intel.com> Tested-by: Ammy Yi <ammy.yi@intel.com> CC: stable@vger.kernel.org # v4.20+ Link: https://lore.kernel.org/r/20191114064201.43089-2-alexander.shishkin@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
e9cb0497b1
commit
0a8f72fafb
1 changed files with 4 additions and 0 deletions
|
@ -345,7 +345,11 @@ void stp_policy_unbind(struct stp_policy *policy)
|
||||||
stm->policy = NULL;
|
stm->policy = NULL;
|
||||||
policy->stm = NULL;
|
policy->stm = NULL;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Drop the reference on the protocol driver and lose the link.
|
||||||
|
*/
|
||||||
stm_put_protocol(stm->pdrv);
|
stm_put_protocol(stm->pdrv);
|
||||||
|
stm->pdrv = NULL;
|
||||||
stm_put_device(stm);
|
stm_put_device(stm);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue