Commit 0cb03b6e authored by Arnd Bergmann's avatar Arnd Bergmann Committed by Greg Kroah-Hartman

dvb-usb-v2: avoid use-after-free

commit 00514537 upstream.

I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:

drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.

This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.
Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ea6d8d67
...@@ -1010,8 +1010,8 @@ EXPORT_SYMBOL(dvb_usbv2_probe); ...@@ -1010,8 +1010,8 @@ EXPORT_SYMBOL(dvb_usbv2_probe);
void dvb_usbv2_disconnect(struct usb_interface *intf) void dvb_usbv2_disconnect(struct usb_interface *intf)
{ {
struct dvb_usb_device *d = usb_get_intfdata(intf); struct dvb_usb_device *d = usb_get_intfdata(intf);
const char *name = d->name; const char *devname = kstrdup(dev_name(&d->udev->dev), GFP_KERNEL);
struct device dev = d->udev->dev; const char *drvname = d->name;
dev_dbg(&d->udev->dev, "%s: bInterfaceNumber=%d\n", __func__, dev_dbg(&d->udev->dev, "%s: bInterfaceNumber=%d\n", __func__,
intf->cur_altsetting->desc.bInterfaceNumber); intf->cur_altsetting->desc.bInterfaceNumber);
...@@ -1021,8 +1021,9 @@ void dvb_usbv2_disconnect(struct usb_interface *intf) ...@@ -1021,8 +1021,9 @@ void dvb_usbv2_disconnect(struct usb_interface *intf)
dvb_usbv2_exit(d); dvb_usbv2_exit(d);
dev_info(&dev, "%s: '%s' successfully deinitialized and disconnected\n", pr_info("%s: '%s:%s' successfully deinitialized and disconnected\n",
KBUILD_MODNAME, name); KBUILD_MODNAME, drvname, devname);
kfree(devname);
} }
EXPORT_SYMBOL(dvb_usbv2_disconnect); EXPORT_SYMBOL(dvb_usbv2_disconnect);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment