kernel.git/drivers/media/rc/lirc_dev.c, branch linux-4.13.y

media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls"

2017-09-27T12:43:20Z

commit a607f51e5a4c421e2097077db88105402099c528 upstream. This reverts commit 5be2b76a9ca4ea5fd3e221114d62eeb0d78267ca. Only when the lirc device is freed, should we drop our reference to rc_dev, else we the rc_dev is freed to early. If userspace has a file descriptor open during unplug, it goes bang. ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10 Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609 -snip- mutex_lock_nested+0x1b/0x20 ? mutex_lock_nested+0x1b/0x20 rc_close.part.6+0x20/0x60 [rc_core] rc_close+0x13/0x20 [rc_core] lirc_dev_fop_close+0x62/0xd0 [lirc_dev] __fput+0x236/0x410 ? fput+0xb0/0xb0 ? do_raw_spin_trylock+0x110/0x110 ? set_rq_offline.part.70+0xa0/0xa0 ____fput+0xe/0x10 task_work_run+0x116/0x180 ? task_work_cancel+0x170/0x170 ? _raw_spin_unlock+0x27/0x40 ? switch_task_namespaces+0x5f/0x90 do_exit+0x68b/0xe80 Fixes: 5be2b76a9ca4 ("[media] lirc_dev: remove superfluous get/put_device() calls") Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

[media] lirc_dev: cleanup includes

2017-06-06T12:06:40Z

Remove superfluous includes and defines. Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: return POLLHUP and POLLERR when device is gone

2017-06-06T12:06:06Z

Most drivers return both values when the device is gone. Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: remove unused module parameter

2017-06-06T12:05:35Z

The "debug" parameter isn't actually used anywhere. Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: remove superfluous get/put_device() calls

2017-06-06T12:05:09Z

device_add() and friends already manage the references to the parent device so these calls aren't necessary. Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: remove lirc_irctl_init() and lirc_cdev_add()

2017-06-06T12:04:35Z

These two functions only make the logic in lirc_register_driver() harder to follow. (Note that almost no other driver calls kobject_set_name() on their cdev so I simply removed that part). Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: merge lirc_register_driver() and lirc_allocate_driver()

2017-06-06T12:03:04Z

Merging the two means that lirc_allocate_buffer() is called before device_add() and cdev_add() which makes more sense. This also simplifies the locking slightly because lirc_allocate_buffer() will always be called with lirc_dev_lock held. Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: make fops mandatory

2017-06-06T12:02:20Z

Every caller of lirc_register_driver() passes their own fops and there are no users of lirc_dev_fop_write() in the kernel tree. Thus we can make fops mandatory and remove lirc_dev_fop_write(). Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: clarify error handling

2017-06-06T12:01:29Z

out_sysfs is misleading, sysfs only comes into play after device_add(). Also, calling device_init() before the rest of struct dev is filled out is clearer. Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

[media] lirc_dev: remove sampling kthread

2017-06-06T12:00:56Z

There are no drivers which use this functionality. Signed-off-by: David Härdeman Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab