Hi!
> dev_pm_put_subsys_data() calls kfree() while holding device power lock, when
> the reference count is 0. Fix it to call kfree() after releasing the lock.
>
> Signed-off-by: Shuah Khan <[email protected]>
> ---
> drivers/base/power/common.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
w> diff --git a/drivers/base/power/common.c b/drivers/base/power/common.c
> index 39c3252..da05fe2 100644
> --- a/drivers/base/power/common.c
> +++ b/drivers/base/power/common.c
> @@ -73,13 +73,17 @@ int dev_pm_put_subsys_data(struct device *dev)
>
> if (--psd->refcount == 0) {
> dev->power.subsys_data = NULL;
> - kfree(psd);
> ret = 1;
> }
>
> out:
> spin_unlock_irq(&dev->power.lock);
>
> + if (ret == 1) {
> + /* kfree() verifies that its argument is nonzero. */
> + kfree(psd);
> + }
> +
> return ret;
> }
Wow, that function is fragile. It returns 0/1/-EINVAL, while being
documented for 0/1...
Patch does not look obviously wrong, but maybe
@@ -73,13 +73,17 @@ int dev_pm_put_subsys_data(struct device *dev)
if (--psd->refcount == 0) {
dev->power.subsys_data = NULL;
+ spin_unlock_irq(&dev->power.lock);
- kfree(psd);
- ret = 1;
+ return 1;
}
Would be cleaner.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures)
http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
