]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/commit
dvb-usb-v2: avoid use-after-free
authorArnd Bergmann <arnd@arndb.de>
Thu, 2 Feb 2017 14:36:01 +0000 (12:36 -0200)
committerThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Wed, 17 May 2017 16:37:54 +0000 (13:37 -0300)
commit0eca635ede76bff0a249fec4485b8a816d9b9db8
tree33eaddbc4e01d34b0db503f2a04346b89434866c
parent8faab4f0be993171631a9af1a2174028806410ba
dvb-usb-v2: avoid use-after-free

BugLink: http://bugs.launchpad.net/bugs/1687045
commit 005145378c9ad7575a01b6ce1ba118fb427f583a upstream.

I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:

drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.

This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c