Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b40769ee authored by Sean Young's avatar Sean Young Committed by Mauro Carvalho Chehab
Browse files

[media] lirc: fix error paths in lirc_cdev_add() 



"c77d17c0 [media] lirc: use-after free" introduces two problems:
cdev_del() can be called with a NULL argument, and the kobject_put()
path will cause a double free.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 00361133

drivers/media/rc/lirc_dev.c

+3 −5
Original line number Original line Diff line number Diff line
@@ -157,13 +157,13 @@ static const struct file_operations lirc_dev_fops = { 




static int lirc_cdev_add(struct irctl *ir)

static int lirc_cdev_add(struct irctl *ir)

{

{

	int retval = -ENOMEM;

	struct lirc_driver *d = &ir->d;

	struct lirc_driver *d = &ir->d;

	struct cdev *cdev;

	struct cdev *cdev;

	int retval;





	cdev = cdev_alloc();

	cdev = cdev_alloc();

	if (!cdev)

	if (!cdev)

		goto err_out;

		return -ENOMEM;





	if (d->fops) {

	if (d->fops) {

		cdev->ops = d->fops;

		cdev->ops = d->fops;
@@ -177,10 +177,8 @@ static int lirc_cdev_add(struct irctl *ir) 
		goto err_out;

		goto err_out;





	retval = cdev_add(cdev, MKDEV(MAJOR(lirc_base_dev), d->minor), 1);

	retval = cdev_add(cdev, MKDEV(MAJOR(lirc_base_dev), d->minor), 1);

	if (retval) {

	if (retval)

		kobject_put(&cdev->kobj);

		goto err_out;

		goto err_out;

	}





	ir->cdev = cdev;

	ir->cdev = cdev;