]> asedeno.scripts.mit.edu Git - linux.git/commit
media: radio-raremono: change devm_k*alloc to k*alloc
authorLuke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>
Sat, 22 Jun 2019 01:04:38 +0000 (21:04 -0400)
committerMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Thu, 27 Jun 2019 11:35:24 +0000 (07:35 -0400)
commitc666355e60ddb4748ead3bdd983e3f7f2224aaf0
tree9aaf66c53d48a2945072534ff2a1faea4f75d40e
parentb09a2ab2baeb36bf7ef7780405ad172281741c7c
media: radio-raremono: change devm_k*alloc to k*alloc

Change devm_k*alloc to k*alloc to manually allocate memory

The manual allocation and freeing of memory is necessary because when
the USB radio is disconnected, the memory associated with devm_k*alloc
is freed. Meaning if we still have unresolved references to the radio
device, then we get use-after-free errors.

This patch fixes this by manually allocating memory, and freeing it in
the v4l2.release callback that gets called when the last radio device
exits.

Reported-and-tested-by: syzbot+a4387f5b6b799f6becbf@syzkaller.appspotmail.com
Signed-off-by: Luke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil-cisco@xs4all.nl: cleaned up two small checkpatch.pl warnings]
[hverkuil-cisco@xs4all.nl: prefix subject with driver name]
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
drivers/media/radio/radio-raremono.c