[PATCH] cdev: cdev_put oops
authorBrian King <brking@us.ibm.com>
Tue, 12 Jul 2005 20:58:30 +0000 (13:58 -0700)
committerLinus Torvalds <torvalds@g5.osdl.org>
Tue, 12 Jul 2005 23:01:02 +0000 (16:01 -0700)
While fixing an oops in the st driver in a dirty release path, I
encountered an oops in cdev_put for cdevs allocated using cdev_alloc.  If
cdev_del is called when the cdev kobject still has an open user, when the
last cdev_put is called, the cdev_put will call kobject_put, which will end
up ultimately releasing the cdev in cdev_dynamic_release.  Patch fixes the
oops by preventing cdev_put from accessing freed memory.

Signed-off-by: Brian King <brking@us.ibm.com>
Cc: <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
fs/char_dev.c

index a69a5d8a406f982be7eb6cb1fc9c4ff59a858ffa..3b1b1eefdbb01686f127df582143f922bf87c193 100644 (file)
@@ -277,8 +277,9 @@ static struct kobject *cdev_get(struct cdev *p)
 void cdev_put(struct cdev *p)
 {
        if (p) {
+               struct module *owner = p->owner;
                kobject_put(&p->kobj);
-               module_put(p->owner);
+               module_put(owner);
        }
 }