• Sean Young's avatar
    media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls" · a607f51e
    Sean Young authored
    This reverts commit 5be2b76a.
    
    Only when the lirc device is freed, should we drop our reference to
    rc_dev, else we the rc_dev is freed to early. If userspace has
    a file descriptor open during unplug, it goes bang.
    
    ==================================================================
    BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10
    Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609
    
    -snip-
     mutex_lock_nested+0x1b/0x20
     ? mutex_lock_nested+0x1b/0x20
     rc_close.part.6+0x20/0x60 [rc_core]
     rc_close+0x13/0x20 [rc_core]
     lirc_dev_fop_close+0x62/0xd0 [lirc_dev]
     __fput+0x236/0x410
     ? fput+0xb0/0xb0
     ? do_raw_spin_trylock+0x110/0x110
     ? set_rq_offline.part.70+0xa0/0xa0
     ____fput+0xe/0x10
     task_work_run+0x116/0x180
     ? task_work_cancel+0x170/0x170
     ? _raw_spin_unlock+0x27/0x40
     ? switch_task_namespaces+0x5f/0x90
     do_exit+0x68b/0xe80
    
    Cc: stable@vger.kernel.org # For Kernel 4.13
    Fixes: 5be2b76a ("[media] lirc_dev: remove superfluous get/put_device() calls")
    Signed-off-by: default avatarSean Young <sean@mess.org>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
    a607f51e
lirc_dev.c 12.6 KB