]> pilppa.com Git - linux-2.6-omap-h63xx.git/commitdiff
[PATCH] ibmasm: use after free fix
authorMax Asbock <masbock@us.ibm.com>
Fri, 10 Mar 2006 01:33:48 +0000 (17:33 -0800)
committerLinus Torvalds <torvalds@g5.osdl.org>
Fri, 10 Mar 2006 03:47:37 +0000 (19:47 -0800)
The kobject_put() can free the memory at *cmd, but cmd->lock points to a
persistent lock that is not freed with cmd.

Signed-off-by: Max Asbock <masbock@us.ibm.com>
Cc: Vernon Mauery <vernux@us.ibm.com>
Cc: Srihari Vijayaraghavan <sriharivijayaraghavan@yahoo.com.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
drivers/misc/ibmasm/ibmasm.h

index 1cef2387fa65f05eaffb1830f692a2c5278cc5c7..6aba419544488c58571d115f264368d30b3bed67 100644 (file)
@@ -101,15 +101,16 @@ struct command {
 static inline void command_put(struct command *cmd)
 {
        unsigned long flags;
+       spinlock_t *lock = cmd->lock;
 
-       spin_lock_irqsave(cmd->lock, flags);
-        kobject_put(&cmd->kobj);
-       spin_unlock_irqrestore(cmd->lock, flags);
+       spin_lock_irqsave(lock, flags);
+       kobject_put(&cmd->kobj);
+       spin_unlock_irqrestore(lock, flags);
 }
 
 static inline void command_get(struct command *cmd)
 {
-        kobject_get(&cmd->kobj);
+       kobject_get(&cmd->kobj);
 }