• Mauro Carvalho Chehab's avatar
    [media] media-device: dynamically allocate struct media_devnode · a087ce70
    Mauro Carvalho Chehab authored
    struct media_devnode is currently embedded at struct media_device.
    
    While this works fine during normal usage, it leads to a race
    condition during devnode unregister. the problem is that drivers
    assume that, after calling media_device_unregister(), the struct
    that contains media_device can be freed. This is not true, as it
    can't be freed until userspace closes all opened /dev/media devnodes.
    
    In other words, if the media devnode is still open, and media_device
    gets freed, any call to an ioctl will make the core to try to access
    struct media_device, with will cause an use-after-free and even GPF.
    
    Fix this by dynamically allocating the struct media_devnode and only
    freeing it when it is safe.
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
    a087ce70
uvc_driver.c 69.9 KB