mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-12 21:57:43 +00:00
Code Issues Releases Wiki Activity

[media] lirc: prevent use-after free

Browse source 
If you unplug an lirc device while reading from it, you will get an
use after free as the cdev is freed while still in use.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Sean Young 2016-10-31 15:52:26 -02:00 committed by Mauro Carvalho Chehab
parent 12accdcb92
commit afbb110172
1 changed files with 4 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/media/rc/lirc_dev.c
View file

@ -161,15 +161,15 @@ static int lirc_cdev_add(struct irctl *ir)
struct lirc_driver *d = &ir->d;
struct cdev *cdev;
cdev = kzalloc(sizeof(*cdev), GFP_KERNEL);
cdev = cdev_alloc();
if (!cdev)
goto err_out;
if (d->fops) {
cdev_init(cdev, d->fops);
cdev->ops = d->fops;
cdev->owner = d->owner;
} else {
cdev_init(cdev, &lirc_dev_fops);
cdev->ops = &lirc_dev_fops;
cdev->owner = THIS_MODULE;
}
retval = kobject_set_name(&cdev->kobj, "lirc%d", d->minor);
@ -187,7 +187,7 @@ static int lirc_cdev_add(struct irctl *ir)
return 0;
err_out:
kfree(cdev);
cdev_del(cdev);
return retval;
}
@ -417,7 +417,6 @@ int lirc_unregister_driver(int minor)
} else {
lirc_irctl_cleanup(ir);
cdev_del(cdev);
kfree(cdev);
kfree(ir);
irctls[minor] = NULL;
}
@ -518,7 +517,6 @@ int lirc_dev_fop_close(struct inode *inode, struct file *file)
lirc_irctl_cleanup(ir);
cdev_del(cdev);
irctls[ir->d.minor] = NULL;
kfree(cdev);
kfree(ir);
}