From: Ashish Sangwan <a.sang...@samsung.com>
We have hit a race condition while parallely accessing device's uevent
and rmmoding device's driver. In dev_uevent() first dev->driver is checked if
present which becomes true but before calling add_uevent_var
dev->driver is set to NULL and driver is freed in __device_release_driver().
This results in either NULL pointer derefrence or invalid virtual address
access. Fix this race by accessing dev->driver under dev->mutex.
Signed-off-by: Ashish Sangwan <a.sang...@samsung.com>
Signed-off-by: Namjae Jeon <namjae.j...@samsung.com>
---
drivers/base/core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 97e2baf..f8e854a 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -326,8 +326,15 @@ static int dev_uevent(struct kset *kset, struct kobject
*kobj,
if (dev->type && dev->type->name)
add_uevent_var(env, "DEVTYPE=%s", dev->type->name);
+ /*
+ * dev->driver is set NULL under dev->mutex so it should be checked
+ * after acquiring dev->mutex. This prevents a race between
+ * __device_release_driver and dev_uevent.
+ */
+ device_lock(dev);
if (dev->driver)
add_uevent_var(env, "DRIVER=%s", dev->driver->name);
+ device_unlock(dev);
/* Add common DT information about the device */
of_device_uevent(dev, env);
--
1.7.11.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
