mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-29 23:53:32 +00:00
sunsu: Fix use after free in su_remove().
Real serial port 'up' objects are statically allocated from an array in the driver. Keyboard and mouse ports, on the other hand, are dynamically allocated. Unfortunately, we free these dynamic 'up' objects before we unmap the I/O registers. Rearrange su_remove() so that this does not happen. Noticed by Julia Lawall. Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
7c1f6afcf9
commit
9616ff434d
1 changed files with 9 additions and 4 deletions
|
@ -1500,20 +1500,25 @@ static int __devinit su_probe(struct of_device *op, const struct of_device_id *m
|
|||
static int __devexit su_remove(struct of_device *op)
|
||||
{
|
||||
struct uart_sunsu_port *up = dev_get_drvdata(&op->dev);
|
||||
bool kbdms = false;
|
||||
|
||||
if (up->su_type == SU_PORT_MS ||
|
||||
up->su_type == SU_PORT_KBD) {
|
||||
up->su_type == SU_PORT_KBD)
|
||||
kbdms = true;
|
||||
|
||||
if (kbdms) {
|
||||
#ifdef CONFIG_SERIO
|
||||
serio_unregister_port(&up->serio);
|
||||
#endif
|
||||
kfree(up);
|
||||
} else if (up->port.type != PORT_UNKNOWN) {
|
||||
} else if (up->port.type != PORT_UNKNOWN)
|
||||
uart_remove_one_port(&sunsu_reg, &up->port);
|
||||
}
|
||||
|
||||
if (up->port.membase)
|
||||
of_iounmap(&op->resource[0], up->port.membase, up->reg_size);
|
||||
|
||||
if (kbdms)
|
||||
kfree(up);
|
||||
|
||||
dev_set_drvdata(&op->dev, NULL);
|
||||
|
||||
return 0;
|
||||
|
|
Loading…
Reference in a new issue