[PATCH] ibmasm: use after free fix
Max Asbock [Fri, 10 Mar 2006 01:33:48 +0000 (17:33 -0800)]
The kobject_put() can free the memory at *cmd, but cmd->lock points to a
persistent lock that is not freed with cmd.

Signed-off-by: Max Asbock <masbock@us.ibm.com>
Cc: Vernon Mauery <vernux@us.ibm.com>
Cc: Srihari Vijayaraghavan <sriharivijayaraghavan@yahoo.com.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

drivers/misc/ibmasm/ibmasm.h

index 1cef238..6aba419 100644 (file)
@@ -101,15 +101,16 @@ struct command {
 static inline void command_put(struct command *cmd)
 {
        unsigned long flags;
+       spinlock_t *lock = cmd->lock;
 
-       spin_lock_irqsave(cmd->lock, flags);
-        kobject_put(&cmd->kobj);
-       spin_unlock_irqrestore(cmd->lock, flags);
+       spin_lock_irqsave(lock, flags);
+       kobject_put(&cmd->kobj);
+       spin_unlock_irqrestore(lock, flags);
 }
 
 static inline void command_get(struct command *cmd)
 {
-        kobject_get(&cmd->kobj);
+       kobject_get(&cmd->kobj);
 }