pps: Fix a use-after free bug when unregistering a source.
authorGeorge Spelvin <linux@horizon.com>
Tue, 12 Feb 2013 07:27:20 +0000 (02:27 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 14 Apr 2014 13:44:17 +0000 (06:44 -0700)
commitcd59fb14918a6b20c1ac8be121fa6397b97b00cb
tree7532da45342aaddc10775507f2f77e9abd04549e
parent0965dca06d3659d7cdab7a7e40694affc21be3c9
pps: Fix a use-after free bug when unregistering a source.

commit d953e0e837e65ecc1ddaa4f9560f7925878a0de6 upstream.

Remove the cdev from the system (with cdev_del) *before* deallocating it
(in pps_device_destruct, called via kobject_put from device_destroy).

Also prevent deallocating a device with open file handles.

A better long-term fix is probably to remove the cdev from the pps_device
entirely, and instead have all devices reference one global cdev.  Then
the deallocation ordering becomes simpler.

But that's more complex and invasive change, so we leave that
for later.

Signed-off-by: George Spelvin <linux@horizon.com>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Qiang Huang <h.huangqiang@huawei.com>
Cc: Li Zefan <lizefan@huawei.com>
Cc: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/pps/pps.c