diff options
| author | Brian King <brking@us.ibm.com> | 2005-07-12 13:58:30 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-07-12 16:01:02 -0700 |
| commit | 7da6844cf7bc44dcda548a0a0aebf85f3a1c1485 (patch) | |
| tree | 9105032fd6803f2e0d6a24a483145f39ef5fdecd | |
| parent | 50a5223428bbe77bc0f312100c950b6f4520ba34 (diff) | |
[PATCH] cdev: cdev_put oops
While fixing an oops in the st driver in a dirty release path, I
encountered an oops in cdev_put for cdevs allocated using cdev_alloc. If
cdev_del is called when the cdev kobject still has an open user, when the
last cdev_put is called, the cdev_put will call kobject_put, which will end
up ultimately releasing the cdev in cdev_dynamic_release. Patch fixes the
oops by preventing cdev_put from accessing freed memory.
Signed-off-by: Brian King <brking@us.ibm.com>
Cc: <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | fs/char_dev.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/char_dev.c b/fs/char_dev.c index a69a5d8a406..3b1b1eefdbb 100644 --- a/fs/char_dev.c +++ b/fs/char_dev.c @@ -277,8 +277,9 @@ static struct kobject *cdev_get(struct cdev *p) void cdev_put(struct cdev *p) { if (p) { + struct module *owner = p->owner; kobject_put(&p->kobj); - module_put(p->owner); + module_put(owner); } } |