Re: [PATCH] media: fix use-after-free in cdev_put() when app exits after driver unbind

2016-05-03 Thread Lars-Peter Clausen
On 05/03/2016 05:06 PM, Shuah Khan wrote: > On 05/02/2016 04:16 AM, Lars-Peter Clausen wrote: >> On 04/30/2016 12:37 AM, Shuah Khan wrote: >> [...] >>> diff --git a/include/media/media-devnode.h b/include/media/media-devnode.h >>> index 5bb3b0e..ce9b051 100644 >>> --- a/include/media/media-devnode.

Re: [PATCH] media: fix use-after-free in cdev_put() when app exits after driver unbind

2016-05-03 Thread Shuah Khan
On 05/02/2016 04:16 AM, Lars-Peter Clausen wrote: > On 04/30/2016 12:37 AM, Shuah Khan wrote: > [...] >> diff --git a/include/media/media-devnode.h b/include/media/media-devnode.h >> index 5bb3b0e..ce9b051 100644 >> --- a/include/media/media-devnode.h >> +++ b/include/media/media-devnode.h >> @@ -7

Re: [PATCH] media: fix use-after-free in cdev_put() when app exits after driver unbind

2016-05-02 Thread Lars-Peter Clausen
On 04/30/2016 12:37 AM, Shuah Khan wrote: [...] > diff --git a/include/media/media-devnode.h b/include/media/media-devnode.h > index 5bb3b0e..ce9b051 100644 > --- a/include/media/media-devnode.h > +++ b/include/media/media-devnode.h > @@ -72,6 +72,7 @@ struct media_file_operations { > * @fops:

[PATCH] media: fix use-after-free in cdev_put() when app exits after driver unbind

2016-04-29 Thread Shuah Khan
When driver unbinds while media_ioctl is in progress, cdev_put() fails with when app exits after driver unbinds. Add a kobject to the media_devnode structure and set this kobject as the cdev parent kobject. This allows cdev_add() to hold a reference to it and release the reference in cdev_del() en