AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-11-25 20:10:50 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

V4L/DVB (13132): fix use-after-free Oops, resulting from a driver-core API change

Browse Source 
Commit b402843787 has broken again re-use of
device objects across device_register() / device_unregister() cycles. Fix
soc-camera by nullifying the struct after device_unregister().

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Guennadi Liakhovetski 2009-10-05 12:54:54 -03:00 committed by Mauro Carvalho Chehab
parent 07bc46e667
commit 76823b791d
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/media/video/soc_camera.c
View File

@ -1160,13 +1160,15 @@ void soc_camera_host_unregister(struct soc_camera_host *ici)
if (icd->iface == ici->nr) { if (icd->iface == ici->nr) {
/* The bus->remove will be called */ /* The bus->remove will be called */
device_unregister(&icd->dev); device_unregister(&icd->dev);
/* Not before device_unregister(), .remove /*
* needs parent to call ici->ops->remove() */ * Not before device_unregister(), .remove
icd->dev.parent = NULL; * needs parent to call ici->ops->remove().
* If the host module is loaded again, device_register()
/* If the host module is loaded again, device_register() * would complain "already initialised," since 2.6.32
* would complain "already initialised" */ * this is also needed to prevent use-after-free of the
memset(&icd->dev.kobj, 0, sizeof(icd->dev.kobj)); * device private data.
*/
memset(&icd->dev, 0, sizeof(icd->dev));
} }
} }