mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-30 08:02:30 +00:00
c666355e60
Change devm_k*alloc to k*alloc to manually allocate memory The manual allocation and freeing of memory is necessary because when the USB radio is disconnected, the memory associated with devm_k*alloc is freed. Meaning if we still have unresolved references to the radio device, then we get use-after-free errors. This patch fixes this by manually allocating memory, and freeing it in the v4l2.release callback that gets called when the last radio device exits. Reported-and-tested-by: syzbot+a4387f5b6b799f6becbf@syzkaller.appspotmail.com Signed-off-by: Luke Nowakowski-Krijger <lnowakow@eng.ucsd.edu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil-cisco@xs4all.nl: cleaned up two small checkpatch.pl warnings] [hverkuil-cisco@xs4all.nl: prefix subject with driver name] Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
||
---|---|---|
.. | ||
si470x | ||
si4713 | ||
wl128x | ||
dsbr100.c | ||
Kconfig | ||
lm7000.h | ||
Makefile | ||
radio-aimslab.c | ||
radio-aztech.c | ||
radio-cadet.c | ||
radio-gemtek.c | ||
radio-isa.c | ||
radio-isa.h | ||
radio-keene.c | ||
radio-ma901.c | ||
radio-maxiradio.c | ||
radio-miropcm20.c | ||
radio-mr800.c | ||
radio-raremono.c | ||
radio-rtrack2.c | ||
radio-sf16fmi.c | ||
radio-sf16fmr2.c | ||
radio-shark.c | ||
radio-shark2.c | ||
radio-si476x.c | ||
radio-tea5764.c | ||
radio-tea5777.c | ||
radio-tea5777.h | ||
radio-terratec.c | ||
radio-timb.c | ||
radio-trust.c | ||
radio-typhoon.c | ||
radio-wl1273.c | ||
radio-zoltrix.c | ||
saa7706h.c | ||
tea575x.c | ||
tef6862.c |