Merge "driver core : Fix use after free of dev->parent in device_shutdown" (aee572a5) · Commits · e / devices / android_kernel_sony_msm8994

drivers/base/core.c

+7 −7

Original line number	Diff line number	Diff line
		@@ -1839,7 +1839,7 @@ EXPORT_SYMBOL_GPL(device_move);
		*/
		void device_shutdown(void)
		{
		struct device *dev;
		struct device dev, parent;

		spin_lock(&devices_kset->list_lock);
		/*
		@@ -1856,7 +1856,7 @@ void device_shutdown(void)
		* prevent it from being freed because parent's
		* lock is to be held
		*/
		get_device(dev->parent);
		parent = get_device(dev->parent);
		get_device(dev);
		/*
		* Make sure the device is off the kset list, in the
		@@ -1866,8 +1866,8 @@ void device_shutdown(void)
		spin_unlock(&devices_kset->list_lock);

		/* hold lock to avoid race with probe/release */
		if (dev->parent)
		device_lock(dev->parent);
		if (parent)
		device_lock(parent);
		device_lock(dev);

		/* Don't allow any more runtime suspends */
		@@ -1885,11 +1885,11 @@ void device_shutdown(void)
		}

		device_unlock(dev);
		if (dev->parent)
		device_unlock(dev->parent);
		if (parent)
		device_unlock(parent);

		put_device(dev);
		put_device(dev->parent);
		put_device(parent);

		spin_lock(&devices_kset->list_lock);
		}