From: Max Asbock Date: Fri, 10 Mar 2006 01:33:48 +0000 (-0800) Subject: [PATCH] ibmasm: use after free fix X-Git-Tag: v2.6.16-rc6~36 X-Git-Url: http://www.pilppa.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=6a88231fc7da311e4da4ce2011d1a132c80c145a;p=linux-2.6-omap-h63xx.git [PATCH] ibmasm: use after free fix The kobject_put() can free the memory at *cmd, but cmd->lock points to a persistent lock that is not freed with cmd. Signed-off-by: Max Asbock Cc: Vernon Mauery Cc: Srihari Vijayaraghavan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/drivers/misc/ibmasm/ibmasm.h b/drivers/misc/ibmasm/ibmasm.h index 1cef2387fa6..6aba4195444 100644 --- a/drivers/misc/ibmasm/ibmasm.h +++ b/drivers/misc/ibmasm/ibmasm.h @@ -101,15 +101,16 @@ struct command { static inline void command_put(struct command *cmd) { unsigned long flags; + spinlock_t *lock = cmd->lock; - spin_lock_irqsave(cmd->lock, flags); - kobject_put(&cmd->kobj); - spin_unlock_irqrestore(cmd->lock, flags); + spin_lock_irqsave(lock, flags); + kobject_put(&cmd->kobj); + spin_unlock_irqrestore(lock, flags); } static inline void command_get(struct command *cmd) { - kobject_get(&cmd->kobj); + kobject_get(&cmd->kobj); }