diff options
| author |   Sean Young <sean@mess.org> | 2020-08-08 13:38:02 +0200 |
|---|---|---|
| committer |   Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2020-08-28 14:06:36 +0200 |
| commit | a2e2d73fa28136598e84db9d021091f1b98cbb1a (patch) | |
| tree | e58ed1afb1381aa0fed5c6163d37d496a652ebc1 /drivers/media/rc | |
| parent | media: rc: uevent sysfs file races with rc_unregister_device() (diff) | |
| download | linux-dev-a2e2d73fa28136598e84db9d021091f1b98cbb1a.tar.xz linux-dev-a2e2d73fa28136598e84db9d021091f1b98cbb1a.zip | |
media: rc: do not access device via sysfs after rc_unregister_device()
Device drivers do not expect to have change_protocol or wakeup
re-programming to be accesed after rc_unregister_device(). This can
cause the device driver to access deallocated resources.
Cc: <stable@vger.kernel.org> # 4.16+
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/media/rc')
| -rw-r--r-- | drivers/media/rc/rc-main.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c index e1cda80a4b25..dee8a9f3d80a 100644 --- a/drivers/media/rc/rc-main.c +++ b/drivers/media/rc/rc-main.c @@ -1292,6 +1292,10 @@ static ssize_t store_protocols(struct device *device, } mutex_lock(&dev->lock); + if (!dev->registered) { + mutex_unlock(&dev->lock); + return -ENODEV; + } old_protocols = *current_protocols; new_protocols = old_protocols; @@ -1430,6 +1434,10 @@ static ssize_t store_filter(struct device *device, return -EINVAL; mutex_lock(&dev->lock); + if (!dev->registered) { + mutex_unlock(&dev->lock); + return -ENODEV; + } new_filter = *filter; if (fattr->mask) @@ -1544,6 +1552,10 @@ static ssize_t store_wakeup_protocols(struct device *device, int i; mutex_lock(&dev->lock); + if (!dev->registered) { + mutex_unlock(&dev->lock); + return -ENODEV; + } allowed = dev->allowed_wakeup_protocols; |