mirror of
https://github.com/torvalds/linux.git
synced 2024-12-13 06:32:50 +00:00
a087ce704b
struct media_devnode is currently embedded at struct media_device. While this works fine during normal usage, it leads to a race condition during devnode unregister. the problem is that drivers assume that, after calling media_device_unregister(), the struct that contains media_device can be freed. This is not true, as it can't be freed until userspace closes all opened /dev/media devnodes. In other words, if the media devnode is still open, and media_device gets freed, any call to an ioctl will make the core to try to access struct media_device, with will cause an use-after-free and even GPF. Fix this by dynamically allocating the struct media_devnode and only freeing it when it is safe. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| uvc_ctrl.c | ||
| uvc_debugfs.c | ||
| uvc_driver.c | ||
| uvc_entity.c | ||
| uvc_isight.c | ||
| uvc_queue.c | ||
| uvc_status.c | ||
| uvc_v4l2.c | ||
| uvc_video.c | ||
| uvcvideo.h | ||