diff options
author | Jesper Juhl <jesper.juhl@gmail.com> | 2006-06-23 13:27:36 -0300 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@infradead.org> | 2006-06-25 02:05:14 -0300 |
commit | bafefc0cf8e4b34fbb159ea2e2aef2358ebff935 (patch) | |
tree | b4099efa66238c30f0bd94a2a4c7c86c30c5fe59 /drivers/media/video | |
parent | 7597e8e71f897449a26d5a32eedc09f8e76ae52a (diff) |
V4L/DVB (4154): Fix use-after-free bug in cpia2 driver
The coverity checker detected a use-after-free error in
drivers/media/video/cpia2/cpia2_v4l.c::cpia2_close() (coverity
error #1281).
What happens is that we lock cam->busy_lock, then proceed to free
resources, and in the case of (--cam->open_count == 0) we finish off by
doing a kfree(cam) and then at the end of the function we do a
mutex_unlock(&cam->busy_lock) which will explode since it'll dereference
the free'd `cam' :
...
mutex_lock(&cam->busy_lock);
...
if (--cam->open_count == 0) {
...
if (!cam->present) {
video_unregister_device(dev);
kfree(cam);
}
}
mutex_unlock(&cam->busy_lock); <--- PROBLEM, cam no longer around.
...
Since this only happens in the case of open_count going down to zero I
don't see a problem with just releasing the mutex after unregistering the
device and just before the kfree(). In this case there is nothing around
that we can race against; we are in the release method, open_count is zero,
(!cam->present) and the device has just been unregistered, so letting go of
the mutex at this point looks safe to me.
Patch below to implement that solution.
Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'drivers/media/video')
-rw-r--r-- | drivers/media/video/cpia2/cpia2_v4l.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/video/cpia2/cpia2_v4l.c b/drivers/media/video/cpia2/cpia2_v4l.c index 28d93c595df0..d129db57fcd4 100644 --- a/drivers/media/video/cpia2/cpia2_v4l.c +++ b/drivers/media/video/cpia2/cpia2_v4l.c @@ -343,7 +343,9 @@ static int cpia2_close(struct inode *inode, struct file *file) cpia2_free_buffers(cam); if (!cam->present) { video_unregister_device(dev); + mutex_unlock(&cam->busy_lock); kfree(cam); + return 0; } } |