From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:49804 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752389AbdIVMEF (ORCPT ); Fri, 22 Sep 2017 08:04:05 -0400 Subject: Patch "media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls"" has been added to the 4.13-stable tree To: sean@mess.org, gregkh@linuxfoundation.org, mchehab@s-opensource.com Cc: , From: Date: Fri, 22 Sep 2017 14:04:08 +0200 Message-ID: <150608184819115@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls" to the 4.13-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: media-revert-lirc_dev-remove-superfluous-get-put_device-calls.patch and it can be found in the queue-4.13 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From a607f51e5a4c421e2097077db88105402099c528 Mon Sep 17 00:00:00 2001 From: Sean Young Date: Fri, 4 Aug 2017 10:12:03 -0400 Subject: media: Revert "[media] lirc_dev: remove superfluous get/put_device() calls" From: Sean Young commit a607f51e5a4c421e2097077db88105402099c528 upstream. This reverts commit 5be2b76a9ca4ea5fd3e221114d62eeb0d78267ca. Only when the lirc device is freed, should we drop our reference to rc_dev, else we the rc_dev is freed to early. If userspace has a file descriptor open during unplug, it goes bang. ================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x7bb/0x1e10 Read of size 8 at addr ffff8801d7d61ed0 by task ir-rec/2609 -snip- mutex_lock_nested+0x1b/0x20 ? mutex_lock_nested+0x1b/0x20 rc_close.part.6+0x20/0x60 [rc_core] rc_close+0x13/0x20 [rc_core] lirc_dev_fop_close+0x62/0xd0 [lirc_dev] __fput+0x236/0x410 ? fput+0xb0/0xb0 ? do_raw_spin_trylock+0x110/0x110 ? set_rq_offline.part.70+0xa0/0xa0 ____fput+0xe/0x10 task_work_run+0x116/0x180 ? task_work_cancel+0x170/0x170 ? _raw_spin_unlock+0x27/0x40 ? switch_task_namespaces+0x5f/0x90 do_exit+0x68b/0xe80 Fixes: 5be2b76a9ca4 ("[media] lirc_dev: remove superfluous get/put_device() calls") Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/rc/lirc_dev.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -59,6 +59,8 @@ static void lirc_release(struct device * { struct irctl *ir = container_of(ld, struct irctl, dev); + put_device(ir->dev.parent); + if (ir->buf_internal) { lirc_buffer_free(ir->buf); kfree(ir->buf); @@ -218,6 +220,8 @@ int lirc_register_driver(struct lirc_dri mutex_unlock(&lirc_dev_lock); + get_device(ir->dev.parent); + dev_info(ir->d.dev, "lirc_dev: driver %s registered at minor = %d\n", ir->d.name, ir->d.minor); Patches currently in stable-queue which might be from sean@mess.org are queue-4.13/media-revert-lirc_dev-remove-superfluous-get-put_device-calls.patch