mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-12 21:57:43 +00:00
Code Issues Releases Wiki Activity

[media] lirc: use-after free while reading from device and unplugging

Browse source 
Many lirc drivers have their own receive buffers which are freed on
unplug (e.g. ir_lirc_unregister). This means that ir->buf->wait_poll
will be freed directly after unplug so do not remove yourself from the
wait queue.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Sean Young 2016-10-31 15:52:27 -02:00 committed by Mauro Carvalho Chehab
parent afbb110172
commit c77d17c098
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/media/rc/lirc_dev.c
View file

@ -715,7 +715,7 @@ ssize_t lirc_dev_fop_read(struct file *file,
if (!ir->attached) {
ret = -ENODEV;
break;
goto out_locked;
}
} else {
lirc_buffer_read(ir->buf, buf);