linux-imx/drivers/media
Arnd Bergmann 03662cd00e dvb-usb-v2: avoid use-after-free
commit 005145378c upstream.

I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:

drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.

This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
2017-05-03 14:22:42 +02:00
..
common media: sms: Remove CONFIG_ prefix from Kconfig symbols 2014-09-17 16:55:02 +02:00
dvb-core media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode 2016-03-03 12:46:02 +01:00
dvb-frontends mb86a20s: fix demod settings 2016-10-28 20:36:57 +02:00
firewire firewire: introduce fw_driver.probe and .remove methods 2013-06-09 18:15:00 +02:00
i2c s5k4ecgx: select CRC32 helper 2017-02-15 11:56:08 +01:00
mmc [media] siano: get rid of CammelCase from smscoreapi.h 2013-03-21 10:03:16 -03:00
parport [media] bw-qcam: fix timestamp handling 2013-05-27 09:30:19 -03:00
pci bttv: Width must be a multiple of 16 when capturing planar formats 2016-04-11 16:44:14 +02:00
platform s5p-mfc: Add release callback for memory region devs 2016-08-19 09:51:13 +02:00
radio media: tef6862/radio-tea5764: actually assign clamp result 2013-12-20 07:49:02 -08:00
rc ite-cir: initialize use_demodulator before using it 2017-01-27 11:15:58 +01:00
tuners xc2028: Fix use-after-free bug properly 2017-01-27 17:14:57 +01:00
usb dvb-usb-v2: avoid use-after-free 2017-05-03 14:22:42 +02:00
v4l2-core media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32 2016-04-11 16:44:15 +02:00
Kconfig [media] Fix build when drivers are builtin and frontend modules 2013-06-20 10:35:53 -03:00
Makefile
media-device.c media: media-device: Remove duplicated memset() in media_enum_entities() 2014-09-17 16:55:01 +02:00
media-devnode.c [media] media: Add 64--32 bit compat ioctl handler 2013-03-18 20:44:36 -03:00
media-entity.c [media] media: Add support for circular graph traversal 2013-08-18 07:16:48 -03:00