forked from luck/tmp_suning_uos_patched
c666355e60
Change devm_k*alloc to k*alloc to manually allocate memory The manual allocation and freeing of memory is necessary because when the USB radio is disconnected, the memory associated with devm_k*alloc is freed. Meaning if we still have unresolved references to the radio device, then we get use-after-free errors. This patch fixes this by manually allocating memory, and freeing it in the v4l2.release callback that gets called when the last radio device exits. Reported-and-tested-by: syzbot+a4387f5b6b799f6becbf@syzkaller.appspotmail.com Signed-off-by: Luke Nowakowski-Krijger <lnowakow@eng.ucsd.edu> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> [hverkuil-cisco@xs4all.nl: cleaned up two small checkpatch.pl warnings] [hverkuil-cisco@xs4all.nl: prefix subject with driver name] Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
||
|---|---|---|
| .. | ||
| si470x | ||
| si4713 | ||
| wl128x | ||
| dsbr100.c | ||
| Kconfig | ||
| lm7000.h | ||
| Makefile | ||
| radio-aimslab.c | ||
| radio-aztech.c | ||
| radio-cadet.c | ||
| radio-gemtek.c | ||
| radio-isa.c | ||
| radio-isa.h | ||
| radio-keene.c | ||
| radio-ma901.c | ||
| radio-maxiradio.c | ||
| radio-miropcm20.c | ||
| radio-mr800.c | ||
| radio-raremono.c | ||
| radio-rtrack2.c | ||
| radio-sf16fmi.c | ||
| radio-sf16fmr2.c | ||
| radio-shark.c | ||
| radio-shark2.c | ||
| radio-si476x.c | ||
| radio-tea5764.c | ||
| radio-tea5777.c | ||
| radio-tea5777.h | ||
| radio-terratec.c | ||
| radio-timb.c | ||
| radio-trust.c | ||
| radio-typhoon.c | ||
| radio-wl1273.c | ||
| radio-zoltrix.c | ||
| saa7706h.c | ||
| tea575x.c | ||
| tef6862.c | ||