From: Sean Young <s...@mess.org>

commit a2e2d73fa28136598e84db9d021091f1b98cbb1a upstream.

Device drivers do not expect to have change_protocol or wakeup
re-programming to be accesed after rc_unregister_device(). This can
cause the device driver to access deallocated resources.

Cc: <sta...@vger.kernel.org> # 4.16+
Signed-off-by: Sean Young <s...@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+hua...@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 drivers/media/rc/rc-main.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1256,6 +1256,10 @@ static ssize_t store_protocols(struct de
        }
 
        mutex_lock(&dev->lock);
+       if (!dev->registered) {
+               mutex_unlock(&dev->lock);
+               return -ENODEV;
+       }
 
        old_protocols = *current_protocols;
        new_protocols = old_protocols;
@@ -1394,6 +1398,10 @@ static ssize_t store_filter(struct devic
                return -EINVAL;
 
        mutex_lock(&dev->lock);
+       if (!dev->registered) {
+               mutex_unlock(&dev->lock);
+               return -ENODEV;
+       }
 
        new_filter = *filter;
        if (fattr->mask)
@@ -1508,6 +1516,10 @@ static ssize_t store_wakeup_protocols(st
        int i;
 
        mutex_lock(&dev->lock);
+       if (!dev->registered) {
+               mutex_unlock(&dev->lock);
+               return -ENODEV;
+       }
 
        allowed = dev->allowed_wakeup_protocols;
 


Reply via email to