linux/drivers/hwtracing/stm
Alexander Shishkin fd085bb176 stm class: Fix a use-after-free
For reasons unknown, the stm_source removal path uses device_destroy()
to kill the underlying device object. Because device_destroy() uses
devt to look for the device to destroy and the fact that stm_source
devices don't have one (or all have the same one), it just picks the
first device in the class, which may well be the wrong one.

That is, loading stm_console and stm_heartbeat and then removing both
will die in dereferencing a freed object.

Since this should have been device_unregister() in the first place,
use it instead of device_destroy().

Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Fixes: 7bd1d4093c ("stm class: Introduce an abstraction for System Trace Module devices")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-09-22 10:28:00 +02:00
..
Kconfig stm class: ftrace: Add ftrace-export-over-stm driver 2016-11-22 17:47:48 -05:00
Makefile stm class: ftrace: Add ftrace-export-over-stm driver 2016-11-22 17:47:48 -05:00
console.c stm class: stm_console: Add kernel-console-over-stm driver 2015-10-04 20:28:58 +01:00
core.c stm class: Fix a use-after-free 2017-09-22 10:28:00 +02:00
dummy_stm.c stm dummy: Mark dummy_stm_packet() with notrace 2016-11-22 17:48:00 -05:00
ftrace.c stm class: ftrace: Add ftrace-export-over-stm driver 2016-11-22 17:47:48 -05:00
heartbeat.c stm class: stm_heartbeat: Make nr_devs parameter read-only 2016-04-08 16:11:51 +03:00
policy.c stm class: Remove unnecessary pointer increment 2016-04-08 16:11:54 +03:00
stm.h stm class: Guard output assignment against concurrency 2016-02-20 14:09:14 -08:00