lkml.org 
[lkml]   [2003]   [Aug]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] Use after free in drivers/media/video/videodev.c
Hi,
I think that there's a bug in videdev.c. Look at
video_unregister_device:

void video_unregister_device(struct video_device *vfd) {
[...]
class_device_unregister(&vfd->class_dev);
devfs_remove(vfd->devfs_name);
video_device[vfd->minor]=NULL;
}

The class_device_unregister will call video_release. This function will
call a ->release callback. As far as I can see drivers do their
own cleanup outside video_unregister_device so there is no problem.

However, if a driver switch to dynamically allocated video_device
this ->release callback will free the struct video_device (look
at video_device_release) and possibly its container. So after
class_device_unregister vfd may be a pointer to deallocated memory.

I think that class_device_unregister should be moved down:

--- 2.6.0.orig/drivers/media/video/videodev.c Tue Aug 12 17:02:29 2003
+++ 2.6.0/drivers/media/video/videodev.c Sat Aug 30 21:13:29 2003
@@ -349,9 +349,9 @@
if(video_device[vfd->minor]!=vfd)
panic("videodev: bad unregister");

- class_device_unregister(&vfd->class_dev);
devfs_remove(vfd->devfs_name);
video_device[vfd->minor]=NULL;
+ class_device_unregister(&vfd->class_dev);
up(&videodev_lock);
}

Luca
--
Reply-To: kronos@kronoz.cjb.net
Home: http://kronoz.cjb.net
The trouble with computers is that they do what you tell them,
not what you want.
D. Cohen
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:48    [W:0.033 / U:1.272 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site