Re: [PATCH] driver core : Fix use after free of dev->parent indevice_shutdown

From: Greg KH
Date: Tue Sep 24 2013 - 18:10:21 EST

On Tue, Sep 24, 2013 at 02:39:08PM -0700, Benson Leung wrote:
> The put_device(dev) at the bottom of the loop of device_shutdown
> may result in the dev being cleaned up. In device_create_release,
> the dev is kfreed.
> However, device_shutdown attempts to use the dev pointer again after
> put_device by referring to dev->parent.
> Copy the parent pointer instead to avoid this condition.
> This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11.
> See bug report :
> This can easily be reproduced when shutting down with
> hidraw devices that report battery condition.
> Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse.
> For example, with the magic mouse :
> The dev in question is "hidraw0"
> dev->parent is "magicmouse"
> In the course of the shutdown for this device, the input event cleanup calls
> a put on hidraw0, decrementing its reference count.
> When we finally get to put_device(dev) in device_shutdown, kobject_cleanup
> is called and device_create_release does kfree(dev).
> dev->parent is no longer valid, and we may crash in
> put_device(dev->parent).
> This change should be applied on any kernel with this change :
> d1c6c030fcec6f860d9bb6c632a3ebe62e28440b
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Benson Leung <bleung@xxxxxxxxxxxx>

The patch makes sense, but I wonder why no one has ever seen this
problem before.


thanks for the fix, I'll queue it up for 3.12-final soon.

greg k-h
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at