diff options
| author | Sean Young <sean@mess.org> | 2020-08-08 13:38:02 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-09-09 19:14:28 +0200 |
| commit | bff924ee40ae3857e7373536fdda203378795e3c (patch) | |
| tree | d9fccec87565dfd2ccf24be3ba33ba74d6bdf05c | |
| parent | 91994b8489a38622bbe4267b6e50f74dc9ef5e8e (diff) | |
| download | linux-bff924ee40ae3857e7373536fdda203378795e3c.tar.gz linux-bff924ee40ae3857e7373536fdda203378795e3c.tar.bz2 linux-bff924ee40ae3857e7373536fdda203378795e3c.zip | |
media: rc: do not access device via sysfs after rc_unregister_device()
commit a2e2d73fa28136598e84db9d021091f1b98cbb1a upstream.
Device drivers do not expect to have change_protocol or wakeup
re-programming to be accesed after rc_unregister_device(). This can
cause the device driver to access deallocated resources.
Cc: <stable@vger.kernel.org> # 4.16+
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/media/rc/rc-main.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c index d7064d664d52..ae154a667fe0 100644 --- a/drivers/media/rc/rc-main.c +++ b/drivers/media/rc/rc-main.c @@ -1292,6 +1292,10 @@ static ssize_t store_protocols(struct device *device, } mutex_lock(&dev->lock); + if (!dev->registered) { + mutex_unlock(&dev->lock); + return -ENODEV; + } old_protocols = *current_protocols; new_protocols = old_protocols; @@ -1430,6 +1434,10 @@ static ssize_t store_filter(struct device *device, return -EINVAL; mutex_lock(&dev->lock); + if (!dev->registered) { + mutex_unlock(&dev->lock); + return -ENODEV; + } new_filter = *filter; if (fattr->mask) @@ -1544,6 +1552,10 @@ static ssize_t store_wakeup_protocols(struct device *device, int i; mutex_lock(&dev->lock); + if (!dev->registered) { + mutex_unlock(&dev->lock); + return -ENODEV; + } allowed = dev->allowed_wakeup_protocols; |