diff options
| author | Sean Young | 2017-08-04 16:12:03 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab | 2017-09-05 13:28:59 +0200 |
| commit | a607f51e5a4c421e2097077db88105402099c528 (patch) | |
| tree | 0dee9497f7ef5aa3d574aca4eb6951c1c64aea0a /drivers/staging/media/atomisp/pci/atomisp2/css2400 | |
| parent | media: add qcom_camss.rst to v4l-drivers rst file (diff) | |
| download | kernel-qcow2-linux-a607f51e5a4c421e2097077db88105402099c528.tar.gz kernel-qcow2-linux-a607f51e5a4c421e2097077db88105402099c528.tar.xz kernel-qcow2-linux-a607f51e5a4c421e2097077db88105402099c528.zip | |
media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls"
This reverts commit 5be2b76a9ca4ea5fd3e221114d62eeb0d78267ca.
Only when the lirc device is freed, should we drop our reference to
rc_dev, else we the rc_dev is freed to early. If userspace has
a file descriptor open during unplug, it goes bang.
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10
Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609
-snip-
mutex_lock_nested+0x1b/0x20
? mutex_lock_nested+0x1b/0x20
rc_close.part.6+0x20/0x60 [rc_core]
rc_close+0x13/0x20 [rc_core]
lirc_dev_fop_close+0x62/0xd0 [lirc_dev]
__fput+0x236/0x410
? fput+0xb0/0xb0
? do_raw_spin_trylock+0x110/0x110
? set_rq_offline.part.70+0xa0/0xa0
____fput+0xe/0x10
task_work_run+0x116/0x180
? task_work_cancel+0x170/0x170
? _raw_spin_unlock+0x27/0x40
? switch_task_namespaces+0x5f/0x90
do_exit+0x68b/0xe80
Cc: stable@vger.kernel.org # For Kernel 4.13
Fixes: 5be2b76a9ca4 ("[media] lirc_dev: remove superfluous get/put_device() calls")
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/staging/media/atomisp/pci/atomisp2/css2400')
0 files changed, 0 insertions, 0 deletions