mirror of
https://github.com/torvalds/linux.git
synced 2024-12-12 06:02:38 +00:00
a087ce704b
struct media_devnode is currently embedded at struct media_device. While this works fine during normal usage, it leads to a race condition during devnode unregister. the problem is that drivers assume that, after calling media_device_unregister(), the struct that contains media_device can be freed. This is not true, as it can't be freed until userspace closes all opened /dev/media devnodes. In other words, if the media devnode is still open, and media_device gets freed, any call to an ioctl will make the core to try to access struct media_device, with will cause an use-after-free and even GPF. Fix this by dynamically allocating the struct media_devnode and only freeing it when it is safe. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> |
||
|---|---|---|
| .. | ||
| airspy | ||
| as102 | ||
| au0828 | ||
| b2c2 | ||
| cpia2 | ||
| cx231xx | ||
| dvb-usb | ||
| dvb-usb-v2 | ||
| em28xx | ||
| go7007 | ||
| gspca | ||
| hackrf | ||
| hdpvr | ||
| msi2500 | ||
| pvrusb2 | ||
| pwc | ||
| s2255 | ||
| siano | ||
| stk1160 | ||
| stkwebcam | ||
| tm6000 | ||
| ttusb-budget | ||
| ttusb-dec | ||
| usbtv | ||
| usbvision | ||
| uvc | ||
| zr364xx | ||
| Kconfig | ||
| Makefile | ||