]> bbs.cooldavid.org Git - net-next-2.6.git/commit
git://bbs.cooldavid.org / net-next-2.6.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7c1f6af) | patch
sunsu: Fix use after free in su_remove().
authorDavid S. Miller <davem@davemloft.net>
Thu, 27 May 2010 04:17:29 +0000 (21:17 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 27 May 2010 04:17:29 +0000 (21:17 -0700)
commit9616ff434d96303689391af3d6e1c845d233405f
treefe467102ce2a59dc2113e8f4da6a4d8185404fdatree | snapshot (tar.bz2 tar.gz zip)
parent7c1f6afcf98fe95fb3f2b70ce01cf66f6db53b5ecommit | diff
sunsu: Fix use after free in su_remove().

Real serial port 'up' objects are statically allocated from an
array in the driver.  Keyboard and mouse ports, on the other
hand, are dynamically allocated.

Unfortunately, we free these dynamic 'up' objects before we unmap the
I/O registers.

Rearrange su_remove() so that this does not happen.

Noticed by Julia Lawall.

Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/serial/sunsu.c diff | blob | blame | history
Clone of davem's net-next-2.6 tree