diff options
| author | Dave Young <hidave.darkstar@gmail.com> | 2011-09-06 14:08:08 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2011-09-22 03:17:53 +0200 |
| commit | 236c5441d70312242b5b32d229259930046a80e5 (patch) | |
| tree | 45575f4f3e36ce88299baf99991b8998a10a00ee /drivers/media/video/v4l2-device.c | |
| parent | [media] v4l: Fix use-after-free case in v4l2_device_release (diff) | |
| download | linux-236c5441d70312242b5b32d229259930046a80e5.tar.xz linux-236c5441d70312242b5b32d229259930046a80e5.zip | |
[media] v4l: Make sure we hold a reference to the v4l2_device before using it
v4l2_device_disconnect() calls dev_get_drvdata() and dev_set_drvdata()
on the device it received in v4l2_device_register(). Get a reference to
the device in v4l2_device_register() to make sure it won't disappear as
long as we need it.
Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Tested-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video/v4l2-device.c')
| -rw-r--r-- | drivers/media/video/v4l2-device.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c index c72856c41434..e6a2c3b302d4 100644 --- a/drivers/media/video/v4l2-device.c +++ b/drivers/media/video/v4l2-device.c @@ -38,6 +38,7 @@ int v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev) mutex_init(&v4l2_dev->ioctl_lock); v4l2_prio_init(&v4l2_dev->prio); kref_init(&v4l2_dev->ref); + get_device(dev); v4l2_dev->dev = dev; if (dev == NULL) { /* If dev == NULL, then name must be filled in by the caller */ @@ -93,6 +94,7 @@ void v4l2_device_disconnect(struct v4l2_device *v4l2_dev) if (dev_get_drvdata(v4l2_dev->dev) == v4l2_dev) dev_set_drvdata(v4l2_dev->dev, NULL); + put_device(v4l2_dev->dev); v4l2_dev->dev = NULL; } EXPORT_SYMBOL_GPL(v4l2_device_disconnect); |