Unverified Commit f238d4e5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!7013 media: edia: dvbdev: fix a use-after-free 

Merge Pull Request from: @ci-robot 
 
PR sync from: liwei <liwei728@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/RBBM3HA4P6TRL5KKXVOQCWSCAZAASG4R/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9L9MA 
 
Link:https://gitee.com/openeuler/kernel/pulls/7013

 

Reviewed-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
Reviewed-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 85096618 4e350881

drivers/media/dvb-core/dvbdev.c

+5 −0
Original line number Diff line number Diff line
@@ -502,6 +502,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL);

		if (!dvbdevfops) {

			kfree(dvbdev);

			*pdvbdev = NULL;

			mutex_unlock(&dvbdev_register_lock);

			return -ENOMEM;

		}
@@ -510,6 +511,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		if (!new_node) {

			kfree(dvbdevfops);

			kfree(dvbdev);

			*pdvbdev = NULL;

			mutex_unlock(&dvbdev_register_lock);

			return -ENOMEM;

		}
@@ -543,6 +545,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		}

		list_del (&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		up_write(&minor_rwsem);

		mutex_unlock(&dvbdev_register_lock);

		return -EINVAL;
@@ -565,6 +568,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvb_media_device_free(dvbdev);

		list_del (&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		mutex_unlock(&dvbdev_register_lock);

		return ret;

	}
@@ -583,6 +587,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvb_media_device_free(dvbdev);

		list_del (&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		mutex_unlock(&dvbdev_register_lock);

		return PTR_ERR(clsdev);

	}