shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 03:40:35 +09:00
Code Issues Packages Projects Releases Wiki Activity

UPSTREAM: [media] lirc: prevent use-after free

Browse Source 
If you unplug an lirc device while reading from it, you will get an
use after free as the cdev is freed while still in use.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
(cherry picked from commit afbb110172)
Signed-off-by: Ziyuan Xu <xzy.xu@rock-chips.com>
This commit is contained in:
Sean Young
2016-10-31 15:52:26 -02:00
committed by Tao Huang
parent 19dabb5183
commit 18fc295b37
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/media/rc/lirc_dev.c
View File

@@ -161,15 +161,15 @@ static int lirc_cdev_add(struct irctl *ir)
struct lirc_driver *d = &ir->d;
struct cdev *cdev;
cdev = kzalloc(sizeof(*cdev), GFP_KERNEL);
cdev = cdev_alloc();
if (!cdev)
goto err_out;
if (d->fops) {
cdev_init(cdev, d->fops);
cdev->ops = d->fops;
cdev->owner = d->owner;
} else {
cdev_init(cdev, &lirc_dev_fops);
cdev->ops = &lirc_dev_fops;
cdev->owner = THIS_MODULE;
}
retval = kobject_set_name(&cdev->kobj, "lirc%d", d->minor);
@@ -187,7 +187,7 @@ static int lirc_cdev_add(struct irctl *ir)
return 0;
err_out:
kfree(cdev);
cdev_del(cdev);
return retval;
}
@@ -417,7 +417,6 @@ int lirc_unregister_driver(int minor)
} else {
lirc_irctl_cleanup(ir);
cdev_del(cdev);
kfree(cdev);
kfree(ir);
irctls[minor] = NULL;
}
@@ -518,7 +517,6 @@ int lirc_dev_fop_close(struct inode *inode, struct file *file)
lirc_irctl_cleanup(ir);
cdev_del(cdev);
irctls[ir->d.minor] = NULL;
kfree(cdev);
kfree(ir);
}