diff options
| author | Sean Young <sean@mess.org> | 2016-11-27 00:31:24 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2016-12-01 17:46:00 +0300 |
| commit | b40769ee2ed09ed6c6da33b0cbdf423ff94f685b (patch) | |
| tree | 1cde9fd2230e29b051db457b9b6b47f4ae130658 /drivers/media | |
| parent | 003611334d5592984e319e08c6b66825aca00290 (diff) | |
| download | linux-b40769ee2ed09ed6c6da33b0cbdf423ff94f685b.tar.xz | |
[media] lirc: fix error paths in lirc_cdev_add()
"c77d17c0 [media] lirc: use-after free" introduces two problems:
cdev_del() can be called with a NULL argument, and the kobject_put()
path will cause a double free.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/rc/lirc_dev.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c index d3039efb4e7c..3854809e8531 100644 --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -157,13 +157,13 @@ static const struct file_operations lirc_dev_fops = { static int lirc_cdev_add(struct irctl *ir) { - int retval = -ENOMEM; struct lirc_driver *d = &ir->d; struct cdev *cdev; + int retval; cdev = cdev_alloc(); if (!cdev) - goto err_out; + return -ENOMEM; if (d->fops) { cdev->ops = d->fops; @@ -177,10 +177,8 @@ static int lirc_cdev_add(struct irctl *ir) goto err_out; retval = cdev_add(cdev, MKDEV(MAJOR(lirc_base_dev), d->minor), 1); - if (retval) { - kobject_put(&cdev->kobj); + if (retval) goto err_out; - } ir->cdev = cdev; |