https://github.com/torvalds/linux
Revision e77b89f13a0d48aea70b69976e854f2a2444a519 authored by Dmitry Monakhov on 04 October 2009, 20:38:55 UTC, committed by Dave Jones on 18 November 2009, 04:15:04 UTC
Currently on governer backup/restore path we storing governor's pointer.
This is wrong because one may unload governor's module after cpu goes
offline. As result use-after-free will take place on restored cpu.
It is not easy to exploit this bug, but still we have to close this
issue ASAP. Issue was introduced by following commit
084f34939424161669467c19280dbcf637730314

##TESTCASE##
#!/bin/sh -x
modprobe acpi_cpufreq
# Any non default governor, in may case it is "ondemand"
modprobe cpufreq_ondemand
echo ondemand > /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
rmmod acpi_cpufreq
rmmod cpufreq_ondemand
modprobe acpi_cpufreq  # << use-after-free here.

Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: Dave Jones <davej@redhat.com>
1 parent 293afe4
History
Tip revision: e77b89f13a0d48aea70b69976e854f2a2444a519 authored by Dmitry Monakhov on 04 October 2009, 20:38:55 UTC
[CPUFREQ] Fix use after free on governor restore
Tip revision: e77b89f
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 952 bytes
.mailmap -rw-r--r-- 3.9 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 91.8 KB
Kbuild -rw-r--r-- 2.4 KB
MAINTAINERS -rw-r--r-- 156.0 KB
Makefile -rw-r--r-- 53.9 KB
README -rw-r--r-- 17.0 KB
REPORTING-BUGS -rw-r--r-- 3.3 KB

README

back to top