On Tue, Sep 24, 2013 at 02:39:08PM -0700, Benson Leung wrote: > The put_device(dev) at the bottom of the loop of device_shutdown > may result in the dev being cleaned up. In device_create_release, > the dev is kfreed. > > However, device_shutdown attempts to use the dev pointer again after > put_device by referring to dev->parent. > > Copy the parent pointer instead to avoid this condition. > > This bug was found on Chromium OS's chromeos-3.8, which is based on v3.8.11. > See bug report : https://code.google.com/p/chromium/issues/detail?id=297842 > This can easily be reproduced when shutting down with > hidraw devices that report battery condition. > Two examples are the HP Bluetooth Mouse X4000b and the Apple Magic Mouse. > For example, with the magic mouse : > The dev in question is "hidraw0" > dev->parent is "magicmouse" > > In the course of the shutdown for this device, the input event cleanup calls > a put on hidraw0, decrementing its reference count. > When we finally get to put_device(dev) in device_shutdown, kobject_cleanup > is called and device_create_release does kfree(dev). > dev->parent is no longer valid, and we may crash in > put_device(dev->parent). > > This change should be applied on any kernel with this change : > d1c6c030fcec6f860d9bb6c632a3ebe62e28440b > > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Benson Leung <bleung@xxxxxxxxxxxx> The patch makes sense, but I wonder why no one has ever seen this problem before. Odd... thanks for the fix, I'll queue it up for 3.12-final soon. greg k-h -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html