Unverified Commit 83226bd6 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7084 [sync] PR-7013: media: edia: dvbdev: fix a use-after-free 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/7013 
 
PR sync from: liwei <liwei728@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/RBBM3HA4P6TRL5KKXVOQCWSCAZAASG4R/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9L9MA 
 
Link:https://gitee.com/openeuler/kernel/pulls/7084

 

Reviewed-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 47db1dba b182ddbf

drivers/media/dvb-core/dvbdev.c

+5 −0
Original line number Diff line number Diff line
@@ -498,6 +498,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL);

		if (!dvbdevfops) {

			kfree(dvbdev);

			*pdvbdev = NULL;

			mutex_unlock(&dvbdev_register_lock);

			return -ENOMEM;

		}
@@ -506,6 +507,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		if (!new_node) {

			kfree(dvbdevfops);

			kfree(dvbdev);

			*pdvbdev = NULL;

			mutex_unlock(&dvbdev_register_lock);

			return -ENOMEM;

		}
@@ -538,6 +540,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		}

		list_del (&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		up_write(&minor_rwsem);

		mutex_unlock(&dvbdev_register_lock);

		return -EINVAL;
@@ -560,6 +563,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvb_media_device_free(dvbdev);

		list_del (&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		mutex_unlock(&dvbdev_register_lock);

		return ret;

	}
@@ -578,6 +582,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvb_media_device_free(dvbdev);

		list_del (&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		mutex_unlock(&dvbdev_register_lock);

		return PTR_ERR(clsdev);

	}