diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-11-30 15:23:28 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-11-30 15:23:28 +0100 |
| commit | d3f31301894d1b70d3dc3e8fa5ef3165878338ff (patch) | |
| tree | f2d338029bee54c7a8a462b18cd8ff3e9ed8c59c /drivers | |
| parent | 7cc01c445da868101b9080082b9c75283c261c82 (diff) | |
| parent | 600c0849cf86b75d86352f59745226273290986a (diff) | |
| download | linux-d3f31301894d1b70d3dc3e8fa5ef3165878338ff.tar.bz2 | |
Merge tag 'thunderbolt-for-v5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus
Mika writes:
thunderbolt: Fix for v5.10-rc7
This includes a single fix for use-after-free bug after resume from
hibernation.
* tag 'thunderbolt-for-v5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt:
thunderbolt: Fix use-after-free in remove_unplugged_switch()
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/thunderbolt/icm.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c index 977ba91f4d0e..82c46b200c34 100644 --- a/drivers/thunderbolt/icm.c +++ b/drivers/thunderbolt/icm.c @@ -1976,7 +1976,9 @@ static int complete_rpm(struct device *dev, void *data) static void remove_unplugged_switch(struct tb_switch *sw) { - pm_runtime_get_sync(sw->dev.parent); + struct device *parent = get_device(sw->dev.parent); + + pm_runtime_get_sync(parent); /* * Signal this and switches below for rpm_complete because @@ -1987,8 +1989,10 @@ static void remove_unplugged_switch(struct tb_switch *sw) bus_for_each_dev(&tb_bus_type, &sw->dev, NULL, complete_rpm); tb_switch_remove(sw); - pm_runtime_mark_last_busy(sw->dev.parent); - pm_runtime_put_autosuspend(sw->dev.parent); + pm_runtime_mark_last_busy(parent); + pm_runtime_put_autosuspend(parent); + + put_device(parent); } static void icm_free_unplugged_children(struct tb_switch *sw) |