AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

[media] lirc: use-after free while reading from device and unplugging

Browse Source 
Many lirc drivers have their own receive buffers which are freed on
unplug (e.g. ir_lirc_unregister). This means that ir->buf->wait_poll
will be freed directly after unplug so do not remove yourself from the
wait queue.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Sean Young 2016-10-31 15:52:27 -02:00 committed by Mauro Carvalho Chehab
parent afbb110172
commit c77d17c098
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/media/rc/lirc_dev.c
View File

@ -715,7 +715,7 @@ ssize_t lirc_dev_fop_read(struct file *file,
if (!ir->attached) {
ret = -ENODEV;
break;
goto out_locked;
}
} else {
lirc_buffer_read(ir->buf, buf);