]> git.baikalelectronics.ru Git - kernel.git/commit
media: davinci: vpif: fix use-after-free on driver unbind
authorJohan Hovold <johan@kernel.org>
Wed, 22 Dec 2021 14:20:24 +0000 (15:20 +0100)
committerMauro Carvalho Chehab <mchehab@kernel.org>
Sun, 23 Jan 2022 20:18:43 +0000 (21:18 +0100)
commitae961bb9b0753899e3e48e84a3a95c67f7db4bf5
tree0d74a5b6ee40033055c9a92386eb6ccb8a4073d0
parenteeff2fc2aa627f25f2d7d6f6eb7c7f8755e535a4
media: davinci: vpif: fix use-after-free on driver unbind

The driver allocates and registers two platform device structures during
probe, but the devices were never deregistered on driver unbind.

This results in a use-after-free on driver unbind as the device
structures were allocated using devres and would be freed by driver
core when remove() returns.

Fix this by adding the missing deregistration calls to the remove()
callback and failing probe on registration errors.

Note that the platform device structures must be freed using a proper
release callback to avoid leaking associated resources like device
names.

Fixes: 27dea6cde135 ("[media] davinci: vpif: adaptions for DT support")
Cc: stable@vger.kernel.org # 4.12
Cc: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Lad Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
drivers/media/platform/davinci/vpif.c