From patchwork Fri Jul 1 08:01:37 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andi Shyti X-Patchwork-Id: 9209485 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A045660221 for ; Fri, 1 Jul 2016 08:22:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 915DB2837F for ; Fri, 1 Jul 2016 08:22:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 85F8428695; Fri, 1 Jul 2016 08:22:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 068FA2837F for ; Fri, 1 Jul 2016 08:22:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752514AbcGAIT6 (ORCPT ); Fri, 1 Jul 2016 04:19:58 -0400 Received: from mailout1.samsung.com ([203.254.224.24]:49978 "EHLO mailout1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751533AbcGAIE1 (ORCPT ); Fri, 1 Jul 2016 04:04:27 -0400 Received: from epcpsbgr3.samsung.com (u143.gpu120.samsung.co.kr [203.254.230.143]) by mailout1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0O9M01ZUAMAZG790@mailout1.samsung.com>; Fri, 01 Jul 2016 17:01:48 +0900 (KST) Received: from epcpsbgm1new.samsung.com ( [172.20.52.112]) by epcpsbgr3.samsung.com (EPCPMTA) with SMTP id CC.63.05161.B6326775; Fri, 1 Jul 2016 17:01:47 +0900 (KST) X-AuditID: cbfee68f-f79476d000001429-9a-5776236b7f59 Received: from epmmp2 ( [203.254.227.17]) by epcpsbgm1new.samsung.com (EPCPMTA) with SMTP id 1D.75.02101.B6326775; Fri, 1 Jul 2016 17:01:47 +0900 (KST) Received: from samsunx.samsung ([10.113.63.54]) by mmp2.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0O9M00G9YMAVFJA0@mmp2.samsung.com>; Fri, 01 Jul 2016 17:01:47 +0900 (KST) From: Andi Shyti To: Mauro Carvalho Chehab Cc: Joe Perches , Sean Young , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Andi Shyti , Andi Shyti Subject: [PATCH v2 14/15] [media] lirc_dev: fix potential segfault Date: Fri, 01 Jul 2016 17:01:37 +0900 Message-id: <1467360098-12539-15-git-send-email-andi.shyti@samsung.com> X-Mailer: git-send-email 2.8.1 In-reply-to: <1467360098-12539-1-git-send-email-andi.shyti@samsung.com> References: <1467360098-12539-1-git-send-email-andi.shyti@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrDLMWRmVeSWpSXmKPExsWyRsSkQDdbuSzcoOWHlcX2I89YLRb/eM5k Mfv+YxaLy7vmsFn0bNjKarH6WYXFwqffWRzYPa4v+cTsseSNtceW/rvsHl9WXWP26NuyitHj 8ya5ALYoLpuU1JzMstQifbsErozH07ayFyznrbh86jJTA+Mvri5GTg4JAROJOXc+skLYYhIX 7q1nA7GFBFYwSiw65ABTc6prDlMXIxdQfBajxKwFk6Ccj4wSq7f3MYJUsQloSjTd/gHUzcEh ImAsce6HOkiYWeAAo0RvtwuILSzgJDFj3mcmEJtFQFXi15n3rCDlvALuEp3bMyF2yUlcnv4A 7AZOoPDdd7sYIe5xk5i76x47yFoJgWXsEnNbf7JAzBGQ+Db5EAvIHAkBWYlNB5gh5khKHFxx g2UCo/ACRoZVjKKpBckFxUnpRcZ6xYm5xaV56XrJ+bmbGIGBfvrfs/4djHcPWB9iFOBgVOLh FZhdGi7EmlhWXJl7iNEUaMNEZinR5HxgPOWVxBsamxlZmJqYGhuZW5opifMulPoZLCSQnliS mp2aWpBaFF9UmpNafIiRiYNTqoGx+5uOgdNuy0vS13Ju354nnPJUNZ336f34iOOO/CqJu7+y 7Hi35dQdzq4dd6f7srR9/G157oL7w8uyFp/smsQe2T9cLtxiXyFbsKelPUqHLW79jD1WZxe6 1abzxi7nnlp7NjIt61YlK8dhm+7i4AtK1sy3slOuM6guUOUxb1QpUTi1Kvddzz0lluKMREMt 5qLiRACJCPOdbwIAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrFIsWRmVeSWpSXmKPExsVy+t9jQd1s5bJwg0UfTS22H3nGarH4x3Mm i9n3H7NYXN41h82iZ8NWVovVzyosFj79zuLA7nF9ySdmjyVvrD229N9l9/iy6hqzR9+WVYwe nzfJBbBFNTDaZKQmpqQWKaTmJeenZOal2yp5B8c7x5uaGRjqGlpamCsp5CXmptoqufgE6Lpl 5gCdoqRQlphTChQKSCwuVtK3wzQhNMRN1wKmMULXNyQIrsfIAA0krGHMeDxtK3vBct6Ky6cu MzUw/uLqYuTkkBAwkTjVNYcJwhaTuHBvPVsXIxeHkMAsRolZCyYxQTgfGSVWb+9jBKliE9CU aLr9A6iKg0NEwFji3A91kDCzwAFGid5uFxBbWMBJYsa8z2BDWQRUJX6dec8KUs4r4C7RuT0T YpecxOXpD9hAbE6g8N13u8CmCwm4SczddY99AiPvAkaGVYwSqQXJBcVJ6bmGeanlesWJucWl eel6yfm5mxjB8fRMagfjwV3uhxgFOBiVeHhPfCwNF2JNLCuuzD3EKMHBrCTCayVXFi7Em5JY WZValB9fVJqTWnyI0RToronMUqLJ+cBYzyuJNzQ2MTOyNDI3tDAyNlcS5338f12YkEB6Yklq dmpqQWoRTB8TB6dUA6PCv6s7E4+4JcYG337THt+4TWT245ALLs1rzkuwWebFPkk01vtxNO13 +YS4491vZh63cTgz9+DfxLN/Etctlt3rEPPhEvfnK1w/WmNSg9ZFs/084siyU6mj5+uGbn+v qZKiL/4tT1/weLftbVeDlW7cz2ybvr2Vq6+u/nSgbP+azROFYtPfvXmvxFKckWioxVxUnAgA N4N25r0CAAA= DLP-Filter: Pass X-MTR: 20000000000000000@CPGS X-CFilter-Loop: Reflected Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When opening or closing a lirc character device, the framework provides to the user the possibility to keep track of opening or closing of the device by calling two functions: - set_use_inc() when opening the device - set_use_dec() when closing the device if those are not set by the lirc user, the system segfaults. Check the pointer value before calling the above functions. Signed-off-by: Andi Shyti --- drivers/media/rc/lirc_dev.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c index 4b3efcf..634779a 100644 --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -413,7 +413,10 @@ int lirc_unregister_driver(int minor) ir->d.name, ir->d.minor); wake_up_interruptible(&ir->buf->wait_poll); mutex_lock(&ir->irctl_lock); - ir->d.set_use_dec(ir->d.data); + + if (ir->d.set_use_dec) + ir->d.set_use_dec(ir->d.data); + module_put(cdev->owner); mutex_unlock(&ir->irctl_lock); } else { @@ -471,7 +474,8 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file) cdev = ir->cdev; if (try_module_get(cdev->owner)) { ir->open++; - retval = ir->d.set_use_inc(ir->d.data); + if (ir->d.set_use_inc) + retval = ir->d.set_use_inc(ir->d.data); if (retval) { module_put(cdev->owner); @@ -512,7 +516,8 @@ int lirc_dev_fop_close(struct inode *inode, struct file *file) ir->open--; if (ir->attached) { - ir->d.set_use_dec(ir->d.data); + if (ir->d.set_use_dec) + ir->d.set_use_dec(ir->d.data); module_put(cdev->owner); } else { lirc_irctl_cleanup(ir);