Skip to content

Commit

Permalink
ppdev: fix double-free of pp->pdev->name
Browse files Browse the repository at this point in the history 
free_pardevice() is called by parport_unregister_device() and already frees
pp->pdev->name, don't try to do it again.

This bug causes kernel crashes.

I found and verified this with KASAN and some added pr_emerg()s:

[   60.316568] pp_release: pp->pdev->name == ffff88039cb264c0
[   60.316692] free_pardevice: freeing par_dev->name at ffff88039cb264c0
[   60.316706] pp_release: kfree(ffff88039cb264c0)
[   60.316714] ==========================================================
[   60.316722] BUG: Double free or freeing an invalid pointer
[   60.316731] Unexpected shadow byte: 0xFB
[   60.316801] Object at ffff88039cb264c0, in cache kmalloc-32 size: 32
[   60.316813] Allocated:
[   60.316824] PID = 1695
[   60.316869] Freed:
[   60.316880] PID = 1695
[   60.316935] ==========================================================

Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Jann Horn authored and Greg Kroah-Hartman committed Nov 10, 2016
1 parent f6b2db0 commit b13d143
Showing 1 changed file with 0 additions and 3 deletions.
3 changes: 0 additions & 3 deletions drivers/char/ppdev.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -748,10 +748,7 @@ static int pp_release(struct inode *inode, struct file *file)
}

if (pp->pdev) {
const char *name = pp->pdev->name;

parport_unregister_device(pp->pdev);
kfree(name);
pp->pdev = NULL;
pr_debug(CHRDEV "%x: unregistered pardevice\n", minor);
}
Expand Down

0 comments on commit b13d143

Please sign in to comment.