diff options
| author | Andi Shyti <andi.shyti@samsung.com> | 2016-07-06 12:01:26 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2016-07-13 21:28:25 +0300 |
| commit | 8e5fa4c67d6387d40e2ae350e96fca939ba5e681 (patch) | |
| tree | 366b2860825d9a3b0338d553dd258c46a63622c1 /drivers/media | |
| parent | 62e92682c08885e91113ba742573e736c85db0e4 (diff) | |
| download | linux-8e5fa4c67d6387d40e2ae350e96fca939ba5e681.tar.xz | |
[media] lirc_dev: fix potential segfault
When opening or closing a lirc character device, the framework
provides to the user the possibility to keep track of opening or
closing of the device by calling two functions:
- set_use_inc() when opening the device
- set_use_dec() when closing the device
if those are not set by the lirc user, the system segfaults.
Check the pointer value before calling the above functions.
Signed-off-by: Andi Shyti <andi.shyti@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/rc/lirc_dev.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c index 4be447070fc4..a107ab6bcb88 100644 --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -411,7 +411,10 @@ int lirc_unregister_driver(int minor) ir->d.name, ir->d.minor); wake_up_interruptible(&ir->buf->wait_poll); mutex_lock(&ir->irctl_lock); - ir->d.set_use_dec(ir->d.data); + + if (ir->d.set_use_dec) + ir->d.set_use_dec(ir->d.data); + module_put(cdev->owner); mutex_unlock(&ir->irctl_lock); } else { @@ -469,7 +472,8 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file) cdev = ir->cdev; if (try_module_get(cdev->owner)) { ir->open++; - retval = ir->d.set_use_inc(ir->d.data); + if (ir->d.set_use_inc) + retval = ir->d.set_use_inc(ir->d.data); if (retval) { module_put(cdev->owner); @@ -510,7 +514,8 @@ int lirc_dev_fop_close(struct inode *inode, struct file *file) ir->open--; if (ir->attached) { - ir->d.set_use_dec(ir->d.data); + if (ir->d.set_use_dec) + ir->d.set_use_dec(ir->d.data); module_put(cdev->owner); } else { lirc_irctl_cleanup(ir); |