Unverified Commit 7d91c9c7 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6992 media: edia: dvbdev: fix a use-after-free 

Merge Pull Request from: @ci-robot 
 
PR sync from: liwei <liwei728@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/TCSKYWEMVASEGIGM3QDYOM3YY2WYXJU3/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9L9MA 
 
Link:https://gitee.com/openeuler/kernel/pulls/6992

 

Reviewed-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 4682ccae 13bfac7c

drivers/media/dvb-core/dvbdev.c

+5 −0
Original line number Diff line number Diff line
@@ -498,6 +498,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL);

		if (!dvbdevfops) {

			kfree(dvbdev);

			*pdvbdev = NULL;

			mutex_unlock(&dvbdev_register_lock);

			return -ENOMEM;

		}
@@ -506,6 +507,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		if (!new_node) {

			kfree(dvbdevfops);

			kfree(dvbdev);

			*pdvbdev = NULL;

			mutex_unlock(&dvbdev_register_lock);

			return -ENOMEM;

		}
@@ -537,6 +539,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
			kfree(new_node);

		}

		kfree(dvbdev);

		*pdvbdev = NULL;

		up_write(&minor_rwsem);

		mutex_unlock(&dvbdev_register_lock);

		return -EINVAL;
@@ -558,6 +561,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		}

		dvb_media_device_free(dvbdev);

		kfree(dvbdev);

		*pdvbdev = NULL;

		up_write(&minor_rwsem);

		mutex_unlock(&dvbdev_register_lock);

		return ret;
@@ -576,6 +580,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		}

		dvb_media_device_free(dvbdev);

		kfree(dvbdev);

		*pdvbdev = NULL;

		mutex_unlock(&dvbdev_register_lock);

		return PTR_ERR(clsdev);

	}