From patchwork Wed Jul 6 09:01:26 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andi Shyti X-Patchwork-Id: 9215913 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 05E3760467 for ; Wed, 6 Jul 2016 09:45:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EA359287D1 for ; Wed, 6 Jul 2016 09:45:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DED3D287DB; Wed, 6 Jul 2016 09:45:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8A86C287D1 for ; Wed, 6 Jul 2016 09:45:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753104AbcGFJoC (ORCPT ); Wed, 6 Jul 2016 05:44:02 -0400 Received: from mailout1.samsung.com ([203.254.224.24]:37356 "EHLO mailout1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753022AbcGFJn7 (ORCPT ); Wed, 6 Jul 2016 05:43:59 -0400 Received: from epcpsbgr3.samsung.com (u143.gpu120.samsung.co.kr [203.254.230.143]) by mailout1.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0O9W00LKI0D6UQ60@mailout1.samsung.com>; Wed, 06 Jul 2016 18:43:54 +0900 (KST) Received: from epcpsbgm1new.samsung.com ( [172.20.52.113]) by epcpsbgr3.samsung.com (EPCPMTA) with SMTP id EF.69.05161.AD2DC775; Wed, 6 Jul 2016 18:43:54 +0900 (KST) X-AuditID: cbfee68f-f79476d000001429-43-577cd2dad3ec Received: from epmmp2 ( [203.254.227.17]) by epcpsbgm1new.samsung.com (EPCPMTA) with SMTP id 88.12.02101.AD2DC775; Wed, 6 Jul 2016 18:43:54 +0900 (KST) Received: from samsunx.samsung ([10.113.63.54]) by mmp2.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0O9W003BE0D2J600@mmp2.samsung.com>; Wed, 06 Jul 2016 18:43:54 +0900 (KST) From: Andi Shyti To: Mauro Carvalho Chehab Cc: Joe Perches , Sean Young , Hans Verkuil , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Andi Shyti , Andi Shyti Subject: [PATCH v3 14/15] [media] lirc_dev: fix potential segfault Date: Wed, 06 Jul 2016 18:01:26 +0900 Message-id: <1467795687-10737-15-git-send-email-andi.shyti@samsung.com> X-Mailer: git-send-email 2.8.1 In-reply-to: <1467795687-10737-1-git-send-email-andi.shyti@samsung.com> References: <1467795687-10737-1-git-send-email-andi.shyti@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrOLMWRmVeSWpSXmKPExsWyRsSkUPfWpZpwg6231Sy2H3nGarH4x3Mm i1OTnzFZzL7/mMXi8q45bBY9G7ayWqx+VmGx8Ol3FgcOj+tLPjF7LHlj7bGl/y67x5dV15g9 +rasYvT4vEnO49TXz+wB7FFcNimpOZllqUX6dglcGbuePmApWM5bcaulm7mB8RdXFyMHh4SA icSDNfJdjJxAppjEhXvr2boYuTiEBFYwSux7+okZImEi8fJkHytEYhajxI+XlxghnI+MEltW /WACqWIT0JRouv2DDWSqiICxxLkf6iA1zAJPgSZNnQtWIyzgJLGhfyc7iM0ioCox+d4FsA28 Au4Shw78gtomJ3F5+gOwOZxA8avLlUDCQgJuEvu33WQHmSkhsI1dYvnjy4wQcwQkvk0+xALx jazEpgNQYyQlDq64wTKBUXgBI8MqRtHUguSC4qT0ImO94sTc4tK8dL3k/NxNjMDwP/3vWf8O xrsHrA8xCnAwKvHwVmyuCRdiTSwrrsw9xGgKtGEis5Rocj4wyvJK4g2NzYwsTE1MjY3MLc2U xHkXSv0MFhJITyxJzU5NLUgtii8qzUktPsTIxMEp1cCYYxeW+X5JzJJF3l7Hq6pyPjLvW3Pt WqXonQ8zVmhF8ZVfWXbCawt784YfrRXLXTc7zN747VSLSaCy6Dv1vttrntze7s5Sps1Xvnnp bH2tu4YPjm54d3Kx8z2FRwsFO6xTLjLZOVZL8k9Zr3c2RUZNbcGWdvNrD4v0vFZem8jR9T5r 9eMYkTAfJZbijERDLeai4kQAi0KB/3oCAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrKIsWRmVeSWpSXmKPExsVy+t9jQd1bl2rCDc7/VLTYfuQZq8XiH8+Z LE5NfsZkMfv+YxaLy7vmsFn0bNjKarH6WYXFwqffWRw4PK4v+cTsseSNtceW/rvsHl9WXWP2 6NuyitHj8yY5j1NfP7MHsEc1MNpkpCampBYppOYl56dk5qXbKnkHxzvHm5oZGOoaWlqYKynk Jeam2iq5+AToumXmAB2lpFCWmFMKFApILC5W0rfDNCE0xE3XAqYxQtc3JAiux8gADSSsYczY 9fQBS8Fy3opbLd3MDYy/uLoYOTkkBEwkXp7sY4WwxSQu3FvP1sXIxSEkMItR4sfLS4wQzkdG iS2rfjCBVLEJaEo03f4BVMXBISJgLHHuhzpIDbPAU0aJfVPngtUICzhJbOjfyQ5iswioSky+ d4EZxOYVcJc4dOAXM8Q2OYnL0x+AzeEEil9drgQSFhJwk9i/7Sb7BEbeBYwMqxglUguSC4qT 0nMN81LL9YoTc4tL89L1kvNzNzGCo+yZ1A7Gg7vcDzEKcDAq8fBOeF4dLsSaWFZcmXuIUYKD WUmE1+ZCTbgQb0piZVVqUX58UWlOavEhRlOguyYyS4km5wMTQF5JvKGxiZmRpZG5oYWRsbmS OO/j/+vChATSE0tSs1NTC1KLYPqYODilGhhV9kWttn37/PWNaXtvbLALsd9zLj58yUNW7oof au2xVx5fsll8/lCGW1apdk1nh8kjmxC3qqmdp9g7/uQ4P0gMe5vazXdk2YP9fgsmv08UkBSe O/PHJJ8Ds+Z9KpqlEJL95H9Sge/p9U7fLixm9SyYeHVrzk2GqT7/9fy6Zkr4mkzcYOTou/iT EktxRqKhFnNRcSIAeT+SyMgCAAA= DLP-Filter: Pass X-MTR: 20000000000000000@CPGS X-CFilter-Loop: Reflected Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When opening or closing a lirc character device, the framework provides to the user the possibility to keep track of opening or closing of the device by calling two functions: - set_use_inc() when opening the device - set_use_dec() when closing the device if those are not set by the lirc user, the system segfaults. Check the pointer value before calling the above functions. Signed-off-by: Andi Shyti --- drivers/media/rc/lirc_dev.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c index c78fe2b..8cf5e6b 100644 --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -408,7 +408,10 @@ int lirc_unregister_driver(int minor) ir->d.name, ir->d.minor); wake_up_interruptible(&ir->buf->wait_poll); mutex_lock(&ir->irctl_lock); - ir->d.set_use_dec(ir->d.data); + + if (ir->d.set_use_dec) + ir->d.set_use_dec(ir->d.data); + module_put(cdev->owner); mutex_unlock(&ir->irctl_lock); } else { @@ -466,7 +469,8 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file) cdev = ir->cdev; if (try_module_get(cdev->owner)) { ir->open++; - retval = ir->d.set_use_inc(ir->d.data); + if (ir->d.set_use_inc) + retval = ir->d.set_use_inc(ir->d.data); if (retval) { module_put(cdev->owner); @@ -507,7 +511,8 @@ int lirc_dev_fop_close(struct inode *inode, struct file *file) ir->open--; if (ir->attached) { - ir->d.set_use_dec(ir->d.data); + if (ir->d.set_use_dec) + ir->d.set_use_dec(ir->d.data); module_put(cdev->owner); } else { lirc_irctl_cleanup(ir);