Commit c77d17c0 authored Oct 31, 2016 by Sean Young Committed by Mauro Carvalho Chehab Nov 21, 2016

[media] lirc: use-after free while reading from device and unplugging



Many lirc drivers have their own receive buffers which are freed on
unplug (e.g. ir_lirc_unregister). This means that ir->buf->wait_poll
will be freed directly after unplug so do not remove yourself from the
wait queue.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

parent afbb1101

drivers/media/rc/lirc_dev.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -715,7 +715,7 @@ ssize_t lirc_dev_fop_read(struct file *file,

		if (!ir->attached) {
		ret = -ENODEV;
		break;
		goto out_locked;
		}
		} else {
		lirc_buffer_read(ir->buf, buf);