35e68aef65
commit d0a72efac89d1c35ac55197895201b7b94c5e6ef upstream.
The cpufreq driver has a use-after-free that we can hit if:
a) There's an OCC message pending when the notifier is registered, and
b) The cpufreq driver fails to register with the core.
When a) occurs the notifier schedules a workqueue item to handle the
message. The backing work_struct is located on chips[].throttle and
when b) happens we clean up by freeing the array. Once we get to
the (now free) queued item and the kernel crashes.
Fixes:
|
||
---|---|---|
.. | ||
acpi-cpufreq.c | ||
amd_freq_sensitivity.c | ||
arm_big_little.c | ||
arm_big_little.h | ||
arm_big_little_dt.c | ||
armada-37xx-cpufreq.c | ||
bmips-cpufreq.c | ||
brcmstb-avs-cpufreq.c | ||
cppc_cpufreq.c | ||
cpufreq-dt-platdev.c | ||
cpufreq-dt.c | ||
cpufreq-dt.h | ||
cpufreq-nforce2.c | ||
cpufreq.c | ||
cpufreq_conservative.c | ||
cpufreq_governor.c | ||
cpufreq_governor.h | ||
cpufreq_governor_attr_set.c | ||
cpufreq_ondemand.c | ||
cpufreq_ondemand.h | ||
cpufreq_performance.c | ||
cpufreq_powersave.c | ||
cpufreq_stats.c | ||
cpufreq_userspace.c | ||
davinci-cpufreq.c | ||
e_powersaver.c | ||
elanfreq.c | ||
freq_table.c | ||
gx-suspmod.c | ||
highbank-cpufreq.c | ||
ia64-acpi-cpufreq.c | ||
imx6q-cpufreq.c | ||
intel_pstate.c | ||
Kconfig | ||
Kconfig.arm | ||
Kconfig.powerpc | ||
Kconfig.x86 | ||
kirkwood-cpufreq.c | ||
longhaul.c | ||
longhaul.h | ||
longrun.c | ||
loongson1-cpufreq.c | ||
loongson2_cpufreq.c | ||
Makefile | ||
maple-cpufreq.c | ||
mediatek-cpufreq.c | ||
mvebu-cpufreq.c | ||
omap-cpufreq.c | ||
p4-clockmod.c | ||
pasemi-cpufreq.c | ||
pcc-cpufreq.c | ||
pmac32-cpufreq.c | ||
pmac64-cpufreq.c | ||
powernow-k6.c | ||
powernow-k7.c | ||
powernow-k7.h | ||
powernow-k8.c | ||
powernow-k8.h | ||
powernv-cpufreq.c | ||
ppc_cbe_cpufreq.c | ||
ppc_cbe_cpufreq.h | ||
ppc_cbe_cpufreq_pervasive.c | ||
ppc_cbe_cpufreq_pmi.c | ||
pxa2xx-cpufreq.c | ||
pxa3xx-cpufreq.c | ||
qcom-cpufreq-kryo.c | ||
qoriq-cpufreq.c | ||
s3c24xx-cpufreq-debugfs.c | ||
s3c24xx-cpufreq.c | ||
s3c64xx-cpufreq.c | ||
s3c2410-cpufreq.c | ||
s3c2412-cpufreq.c | ||
s3c2416-cpufreq.c | ||
s3c2440-cpufreq.c | ||
s5pv210-cpufreq.c | ||
sa1100-cpufreq.c | ||
sa1110-cpufreq.c | ||
sc520_freq.c | ||
scmi-cpufreq.c | ||
scpi-cpufreq.c | ||
sfi-cpufreq.c | ||
sh-cpufreq.c | ||
sparc-us2e-cpufreq.c | ||
sparc-us3-cpufreq.c | ||
spear-cpufreq.c | ||
speedstep-centrino.c | ||
speedstep-ich.c | ||
speedstep-lib.c | ||
speedstep-lib.h | ||
speedstep-smi.c | ||
sti-cpufreq.c | ||
tango-cpufreq.c | ||
tegra20-cpufreq.c | ||
tegra124-cpufreq.c | ||
tegra186-cpufreq.c | ||
ti-cpufreq.c | ||
unicore2-cpufreq.c | ||
vexpress-spc-cpufreq.c |