• Hans Verkuil's avatar
    [media] rc-main: fix kernel oops after unloading keymap module · d54fc3bb
    Hans Verkuil authored
    When the rc_map table is created the char pointer of the name of the keymap
    is copied to the rc_map->name field. However, this pointer points to memory
    from the keymap module itself.
    
    Since these keymap modules are not refcounted, that means anyone can call
    rmmod to unload that module. Which is not a big deal because the contents of
    the map is all copied to rc_map, except for the keymap name.
    
    So after a keymap module is unloaded the name pointer has become stale. Unloading
    the rc-core module will now cause a kernel oops in rc_dev_uevent().
    
    The solution is to kstrdup the name so there are no more references to the
    keymap module remaining.
    Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
    d54fc3bb
rc-main.c 41.3 KB