kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

UIO: hold a reference to the device's owner while the device is open

Browse source 
Otherwise the device might just disappear while /dev/uioX is being used
which results in an Oops.

Signed-off-by: Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
Signed-off-by: Hans J Koch <hjk@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Uwe Kleine-König 2008-04-11 11:07:39 +02:00 committed by Greg Kroah-Hartman
parent b54f2863a2
commit 610ad5064c
1 changed files with 21 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
drivers/uio/uio.c
View file

@ -301,23 +301,33 @@ static int uio_open(struct inode *inode, struct file *filep)
if (!idev) if (!idev)
return -ENODEV; return -ENODEV;
if (!try_module_get(idev->owner))
return -ENODEV;
listener = kmalloc(sizeof(*listener), GFP_KERNEL); listener = kmalloc(sizeof(*listener), GFP_KERNEL);
if (!listener) if (!listener) {
return -ENOMEM; ret = -ENOMEM;
goto err_alloc_listener;
}
listener->dev = idev; listener->dev = idev;
listener->event_count = atomic_read(&idev->event); listener->event_count = atomic_read(&idev->event);
filep->private_data = listener; filep->private_data = listener;
if (idev->info->open) { if (idev->info->open) {
if (!try_module_get(idev->owner))
return -ENODEV;
ret = idev->info->open(idev->info, inode); ret = idev->info->open(idev->info, inode);
module_put(idev->owner); if (ret)
goto err_infoopen;
} }
if (ret) return 0;
kfree(listener);
err_infoopen:
kfree(listener);
err_alloc_listener:
module_put(idev->owner);
return ret; return ret;
} }
@ -336,12 +346,11 @@ static int uio_release(struct inode *inode, struct file *filep)
struct uio_listener *listener = filep->private_data; struct uio_listener *listener = filep->private_data;
struct uio_device *idev = listener->dev; struct uio_device *idev = listener->dev;
if (idev->info->release) { if (idev->info->release)
if (!try_module_get(idev->owner))
return -ENODEV;
ret = idev->info->release(idev->info, inode); ret = idev->info->release(idev->info, inode);
module_put(idev->owner);
} module_put(idev->owner);
if (filep->f_flags & FASYNC) if (filep->f_flags & FASYNC)
ret = uio_fasync(-1, filep, 0); ret = uio_fasync(-1, filep, 0);
kfree(listener); kfree(listener);
@ -510,10 +519,7 @@ static int uio_mmap(struct file *filep, struct vm_area_struct *vma)
return -EINVAL; return -EINVAL;
if (idev->info->mmap) { if (idev->info->mmap) {
if (!try_module_get(idev->owner))
return -ENODEV;
ret = idev->info->mmap(idev->info, vma); ret = idev->info->mmap(idev->info, vma);
module_put(idev->owner);
return ret; return ret;
} }