Re: [OOPS][RESEND] 2.6.0-test4-mm4

[Andrew Morton <akpm@osdl.org>]

Bongani Hlope <bonganilinux@mweb.co.za> wrote:
>
> > Is it repeatable?  Exactly which modules were you attempting to load at the
>  > time?  And please send your .config.
>  > 
>  > Thanks.
> 
> 
>  This is repeatable, each time it tries to load the alsa snd module.

OK, it's a straightforward use-after-free in kobject_cleanup().  I snarfed
a patch from Pat which allows arbitrary-length kobject names.  Maybe it
wasn't quite ready yet.

t->release points at cdev_dynamic_release(), which frees the kobj.

This should fix it up.

 lib/kobject.c |   13 ++++++++++---
 1 files changed, 10 insertions(+), 3 deletions(-)

diff -puN lib/kobject.c~kobject-unlimited-name-lengths-use-after-free-fix lib/kobject.c
--- 25/lib/kobject.c~kobject-unlimited-name-lengths-use-after-free-fix	2003-09-01 22:20:27.000000000 -0700
+++ 25-akpm/lib/kobject.c	2003-09-01 22:28:00.000000000 -0700
@@ -443,15 +443,22 @@ void kobject_cleanup(struct kobject * ko
 {
 	struct kobj_type * t = get_ktype(kobj);
 	struct kset * s = kobj->kset;
+	char *name = NULL;
 
 	pr_debug("kobject %s: cleaning up\n",kobject_name(kobj));
+
+	if (kobj->k_name != kobj->name)
+		name = kobj->k_name;
+
 	if (t && t->release)
 		t->release(kobj);
 	if (s)
 		kset_put(s);
-	if (kobj->k_name != kobj->name)
-		kfree(kobj->k_name);
-	kobj->k_name = NULL;
+
+	if (name)
+		kfree(name);
+	else
+		kobj->k_name = NULL;
 }
 
 /**

_