Unverified Commit 8805a586 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4749 [sync] PR-4672: uio: Fix use-after-free in uio_open 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/4672 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/XKPJY3JLX3PS6TQAN23ATHVAGLZ34W7M/ 
 
https://gitee.com/src-openeuler/kernel/issues/I92HXN 
 
Link:https://gitee.com/openeuler/kernel/pulls/4749

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 8d8f92cd 35d0043b

drivers/uio/uio.c

+3 −4
Original line number Diff line number Diff line
@@ -464,13 +464,13 @@ static int uio_open(struct inode *inode, struct file *filep) 


	mutex_lock(&minor_lock);

	idev = idr_find(&uio_idr, iminor(inode));

	mutex_unlock(&minor_lock);

	if (!idev) {

		ret = -ENODEV;

		mutex_unlock(&minor_lock);

		goto out;

	}



	get_device(&idev->dev);

	mutex_unlock(&minor_lock);



	if (!try_module_get(idev->owner)) {

		ret = -ENODEV;
@@ -1062,9 +1062,8 @@ void uio_unregister_device(struct uio_info *info) 
	wake_up_interruptible(&idev->wait);

	kill_fasync(&idev->async_queue, SIGIO, POLL_HUP);



	device_unregister(&idev->dev);



	uio_free_minor(minor);

	device_unregister(&idev->dev);



	return;

}