Sean Young a607f51e5a media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls" ... This reverts commit 5be2b76a9c. Only when the lirc device is freed, should we drop our reference to rc_dev, else we the rc_dev is freed to early. If userspace has a file descriptor open during unplug, it goes bang. ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10 Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609 -snip- mutex_lock_nested+0x1b/0x20 ? mutex_lock_nested+0x1b/0x20 rc_close.part.6+0x20/0x60 [rc_core] rc_close+0x13/0x20 [rc_core] lirc_dev_fop_close+0x62/0xd0 [lirc_dev] __fput+0x236/0x410 ? fput+0xb0/0xb0 ? do_raw_spin_trylock+0x110/0x110 ? set_rq_offline.part.70+0xa0/0xa0 ____fput+0xe/0x10 task_work_run+0x116/0x180 ? task_work_cancel+0x170/0x170 ? _raw_spin_unlock+0x27/0x40 ? switch_task_namespaces+0x5f/0x90 do_exit+0x68b/0xe80 Cc: stable@vger.kernel.org # For Kernel 4.13 Fixes: 5be2b76a9c ("[media] lirc_dev: remove superfluous get/put_device() calls") Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>		2017-09-05 07:28:59 -04:00
..
img-ir
keymaps
ati_remote.c
ene_ir.c
ene_ir.h
fintek-cir.c
fintek-cir.h
gpio-ir-recv.c
gpio-ir-tx.c	media: rc: gpio-ir-tx: use ktime accessor functions	2017-08-31 05:35:54 -04:00
igorplugusb.c
iguanair.c
imon.c
ir-hix5hd2.c
ir-jvc-decoder.c
ir-lirc-codec.c
ir-mce_kbd-decoder.c
ir-nec-decoder.c
ir-rc5-decoder.c
ir-rc6-decoder.c
ir-rx51.c
ir-sanyo-decoder.c
ir-sharp-decoder.c
ir-sony-decoder.c
ir-spi.c
ir-xmp-decoder.c
ite-cir.c
ite-cir.h
Kconfig
lirc_dev.c	media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls"	2017-09-05 07:28:59 -04:00
Makefile
mceusb.c
meson-ir.c
mtk-cir.c
nuvoton-cir.c
nuvoton-cir.h
pwm-ir-tx.c
rc-core-priv.h
rc-ir-raw.c
rc-loopback.c
rc-main.c
redrat3.c
serial_ir.c	media: serial_ir: fix tx timing calculation on 32-bit	2017-08-31 05:36:42 -04:00
sir_ir.c
st_rc.c
streamzap.c
sunxi-cir.c
ttusbir.c
winbond-cir.c
zx-irdec.c