From patchwork Wed Jun 29 13:20:43 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andi Shyti X-Patchwork-Id: 9205081 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 66509607D8 for ; Wed, 29 Jun 2016 13:22:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 57CAD285BA for ; Wed, 29 Jun 2016 13:22:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4CA9A28655; Wed, 29 Jun 2016 13:22:09 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8D4FE28616 for ; Wed, 29 Jun 2016 13:22:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752743AbcF2NVs (ORCPT ); Wed, 29 Jun 2016 09:21:48 -0400 Received: from mailout4.samsung.com ([203.254.224.34]:56899 "EHLO mailout4.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752043AbcF2NVG (ORCPT ); Wed, 29 Jun 2016 09:21:06 -0400 Received: from epcpsbgr3.samsung.com (u143.gpu120.samsung.co.kr [203.254.230.143]) by mailout4.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0O9J00TPFBQXM300@mailout4.samsung.com>; Wed, 29 Jun 2016 22:20:57 +0900 (KST) Received: from epcpsbgm2new.samsung.com ( [172.20.52.113]) by epcpsbgr3.samsung.com (EPCPMTA) with SMTP id 82.6E.05161.93BC3775; Wed, 29 Jun 2016 22:20:57 +0900 (KST) X-AuditID: cbfee68f-f79476d000001429-25-5773cb39918d Received: from epmmp1.local.host ( [203.254.227.16]) by epcpsbgm2new.samsung.com (EPCPMTA) with SMTP id 87.6D.04429.93BC3775; Wed, 29 Jun 2016 06:20:57 -0700 (MST) Received: from samsunx.samsung ([10.113.63.54]) by mmp1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0O9J0087XBQTVM50@mmp1.samsung.com>; Wed, 29 Jun 2016 22:20:57 +0900 (KST) From: Andi Shyti To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Andi Shyti , Andi Shyti Subject: [PATCH 14/15] lirc_dev: fix potential segfault Date: Wed, 29 Jun 2016 22:20:43 +0900 Message-id: <1467206444-9935-15-git-send-email-andi.shyti@samsung.com> X-Mailer: git-send-email 2.8.1 In-reply-to: <1467206444-9935-1-git-send-email-andi.shyti@samsung.com> References: <1467206444-9935-1-git-send-email-andi.shyti@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrFLMWRmVeSWpSXmKPExsWyRsSkUNfydHG4weVuBYvtR56xWiz+8ZzJ 4vKuOWwWPRu2slqsflbhwOpxfcknZo8t/XfZPfq2rGL0+LxJLoAlissmJTUnsyy1SN8ugStj R8t19oLlvBVrjp5ga2D8xdXFyMkhIWAi8etSFwuELSZx4d56ti5GLg4hgRWMEp27XgA5HGBF Z6exQsSXMkq8vPMOyvnIKNF06DwrSDebgKZE0+0fYA0iAsYS536og4SZBZoZJXZfNwKxhQXM JdbtWgdWziKgKrGpeQ8biM0r4Caxf85rdogj5CQuT38AFucEii8/fxMsLiTgKtH69D8jyF4J gXZ2iSWzepkgBglIfJt8iAXiUFmJTQeYIeZIShxccYNlAqPwAkaGVYyiqQXJBcVJ6UXGesWJ ucWleel6yfm5mxiBQXz637P+HYx3D1gfYhTgYFTi4f1xuDhciDWxrLgy9xCjKdCGicxSosn5 wFjJK4k3NDYzsjA1MTU2Mrc0UxLnXSj1M1hIID2xJDU7NbUgtSi+qDQntfgQIxMHp1QDY7XT vYgn8ycoWnDpyEtMnbVOY+rze5K60x0WuyVsCtO0SbtXai9m9ljnVFh/39PG1/MXGadqKG+q zRRW2niqu73UnlciaP5klatZd7bPL43NfBctMslrS3WQncEZ6R3+5/uNPXQF58akhWrd82SY MZ3v6eHCXBVer68Pn6dOi/q7uWeeWdNSJZbijERDLeai4kQAk5wMGV0CAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprOIsWRmVeSWpSXmKPExsVy+t9jAV3L08XhBl97ZSy2H3nGarH4x3Mm i8u75rBZ9GzYymqx+lmFA6vH9SWfmD229N9l9+jbsorR4/MmuQCWqAZGm4zUxJTUIoXUvOT8 lMy8dFsl7+B453hTMwNDXUNLC3MlhbzE3FRbJRefAF23zBygvUoKZYk5pUChgMTiYiV9O0wT QkPcdC1gGiN0fUOC4HqMDNBAwhrGjB0t19kLlvNWrDl6gq2B8RdXFyMHh4SAicTZaaxdjJxA ppjEhXvr2boYuTiEBJYySry8844VwvnIKNF06DxYFZuApkTT7R9sIM0iAsYS536og4SZBZoZ JXZfNwKxhQXMJdbtWgdWziKgKrGpeQ8biM0r4Caxf85rdohlchKXpz8Ai3MCxZefvwkWFxJw lWh9+p9xAiPvAkaGVYwSqQXJBcVJ6blGeanlesWJucWleel6yfm5mxjBkfJMegfj4V3uhxgF OBiVeHgtLhSFC7EmlhVX5h5ilOBgVhLhlTtRHC7Em5JYWZValB9fVJqTWnyI0RTosInMUqLJ +cAoziuJNzQ2MTOyNDI3tDAyNlcS5338f12YkEB6YklqdmpqQWoRTB8TB6dUA2MhX6Ki+oVl 80t/z4sxXxHh66q09228zq5LE2+/mMVjlK8Rstcwyv1I1KTg6T7v6j8y1Z5KeLXxD5fYvQrx h7JPdS9qvd80T11/Q9I1HVauua4z5eQzBe+3+ty2Uvy/53AOq6ZQ2xqRc5m2/wsdeGW/fp1y a5vJnfAgY6XPMxO3XahXDbuqrqbEUpyRaKjFXFScCAALlpz/qgIAAA== DLP-Filter: Pass X-MTR: 20000000000000000@CPGS X-CFilter-Loop: Reflected Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When opening or closing a lirc character device, the framework provides to the user the possibility to keep track of opening or closing of the device by calling two functions: - set_use_inc() when opening the device - set_use_dec() when closing the device if those are not set by the lirc user, the system segfaults. Check the pointer value before calling the above functions. Signed-off-by: Andi Shyti --- drivers/media/rc/lirc_dev.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c index 0a3d65d..58dabdc 100644 --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -412,7 +412,10 @@ int lirc_unregister_driver(int minor) ir->d.name, ir->d.minor); wake_up_interruptible(&ir->buf->wait_poll); mutex_lock(&ir->irctl_lock); - ir->d.set_use_dec(ir->d.data); + + if (ir->d.set_use_dec) + ir->d.set_use_dec(ir->d.data); + module_put(cdev->owner); mutex_unlock(&ir->irctl_lock); } else { @@ -471,7 +474,8 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file) cdev = ir->cdev; if (try_module_get(cdev->owner)) { ir->open++; - retval = ir->d.set_use_inc(ir->d.data); + if (ir->d.set_use_inc) + retval = ir->d.set_use_inc(ir->d.data); if (retval) { module_put(cdev->owner); @@ -512,7 +516,8 @@ int lirc_dev_fop_close(struct inode *inode, struct file *file) ir->open--; if (ir->attached) { - ir->d.set_use_dec(ir->d.data); + if (ir->d.set_use_dec) + ir->d.set_use_dec(ir->d.data); module_put(cdev->owner); } else { lirc_irctl_cleanup(ir);