From fb1a0811d58fdbf564fa22b7fb268969c40af175 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Thu, 8 Jan 2009 23:28:09 -0200 Subject: backport changeset f41ced8f108cc80f16509b907cd7ac93944459bc From: Mauro Carvalho Chehab Author: Laurent Pinchart Check fops_get() return value Several subsystem open handlers dereference the fops_get() return value without checking it for nullness. This opens a race condition between the open handler and module unloading. A module can be marked as being unloaded (MODULE_STATE_GOING) before its exit function is called and gets the chance to unregister the driver. During that window open handlers can still be called, and fops_get() will fail in try_module_get() and return a NULL pointer. This change checks the fops_get() return value and returns -ENODEV if NULL. kernel-sync: Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/dvb-core/dvbdev.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'linux/drivers/media/dvb/dvb-core') diff --git a/linux/drivers/media/dvb/dvb-core/dvbdev.c b/linux/drivers/media/dvb/dvb-core/dvbdev.c index 4267b2b87..940114768 100644 --- a/linux/drivers/media/dvb/dvb-core/dvbdev.c +++ b/linux/drivers/media/dvb/dvb-core/dvbdev.c @@ -84,6 +84,10 @@ static int dvb_device_open(struct inode *inode, struct file *file) file->private_data = dvbdev; old_fops = file->f_op; file->f_op = fops_get(dvbdev->fops); + if (file->f_op == NULL) { + file->f_op = old_fops; + goto fail; + } if(file->f_op->open) err = file->f_op->open(inode,file); if (err) { @@ -95,6 +99,7 @@ static int dvb_device_open(struct inode *inode, struct file *file) unlock_kernel(); return err; } +fail: up_read(&minor_rwsem); unlock_kernel(); return -ENODEV; -- cgit v1.2.3 From 2d4f2fbb05799ae2c5d8cd0c001364ab3f3dbf24 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Sun, 11 Jan 2009 09:12:43 +0000 Subject: dvb: constify VFTs From: Jan Engelhardt dvb: constify VFTs Signed-off-by: Jan Engelhardt Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/dvb/dvb-core/dmxdev.c | 2 +- linux/drivers/media/dvb/dvb-core/dvb_ca_en50221.c | 2 +- linux/drivers/media/dvb/dvb-core/dvb_frontend.c | 2 +- linux/drivers/media/dvb/dvb-core/dvb_net.c | 2 +- linux/drivers/media/dvb/dvb-core/dvbdev.c | 4 ++-- linux/drivers/media/dvb/dvb-core/dvbdev.h | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) (limited to 'linux/drivers/media/dvb/dvb-core') diff --git a/linux/drivers/media/dvb/dvb-core/dmxdev.c b/linux/drivers/media/dvb/dvb-core/dmxdev.c index 0c733c66a..cc143929a 100644 --- a/linux/drivers/media/dvb/dvb-core/dmxdev.c +++ b/linux/drivers/media/dvb/dvb-core/dmxdev.c @@ -1026,7 +1026,7 @@ static int dvb_demux_release(struct inode *inode, struct file *file) return ret; } -static struct file_operations dvb_demux_fops = { +static const struct file_operations dvb_demux_fops = { .owner = THIS_MODULE, .read = dvb_demux_read, .ioctl = dvb_demux_ioctl, diff --git a/linux/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/linux/drivers/media/dvb/dvb-core/dvb_ca_en50221.c index 19965a055..02a4e94cb 100644 --- a/linux/drivers/media/dvb/dvb-core/dvb_ca_en50221.c +++ b/linux/drivers/media/dvb/dvb-core/dvb_ca_en50221.c @@ -1608,7 +1608,7 @@ static unsigned int dvb_ca_en50221_io_poll(struct file *file, poll_table * wait) EXPORT_SYMBOL(dvb_ca_en50221_init); -static struct file_operations dvb_ca_fops = { +static const struct file_operations dvb_ca_fops = { .owner = THIS_MODULE, .read = dvb_ca_en50221_io_read, .write = dvb_ca_en50221_io_write, diff --git a/linux/drivers/media/dvb/dvb-core/dvb_frontend.c b/linux/drivers/media/dvb/dvb-core/dvb_frontend.c index 01a9ceb37..05b327403 100644 --- a/linux/drivers/media/dvb/dvb-core/dvb_frontend.c +++ b/linux/drivers/media/dvb/dvb-core/dvb_frontend.c @@ -1989,7 +1989,7 @@ static int dvb_frontend_release(struct inode *inode, struct file *file) return ret; } -static struct file_operations dvb_frontend_fops = { +static const struct file_operations dvb_frontend_fops = { .owner = THIS_MODULE, .ioctl = dvb_generic_ioctl, .poll = dvb_frontend_poll, diff --git a/linux/drivers/media/dvb/dvb-core/dvb_net.c b/linux/drivers/media/dvb/dvb-core/dvb_net.c index f0cd3b8ed..5f4856c6d 100644 --- a/linux/drivers/media/dvb/dvb-core/dvb_net.c +++ b/linux/drivers/media/dvb/dvb-core/dvb_net.c @@ -1526,7 +1526,7 @@ static int dvb_net_close(struct inode *inode, struct file *file) } -static struct file_operations dvb_net_fops = { +static const struct file_operations dvb_net_fops = { .owner = THIS_MODULE, .ioctl = dvb_net_ioctl, .open = dvb_generic_open, diff --git a/linux/drivers/media/dvb/dvb-core/dvbdev.c b/linux/drivers/media/dvb/dvb-core/dvbdev.c index 940114768..4609e3ebd 100644 --- a/linux/drivers/media/dvb/dvb-core/dvbdev.c +++ b/linux/drivers/media/dvb/dvb-core/dvbdev.c @@ -237,8 +237,8 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvbdev->fops = dvbdevfops; init_waitqueue_head (&dvbdev->wait_queue); - memcpy(dvbdev->fops, template->fops, sizeof(struct file_operations)); - dvbdev->fops->owner = adap->module; + memcpy(dvbdevfops, template->fops, sizeof(struct file_operations)); + dvbdevfops->owner = adap->module; list_add_tail (&dvbdev->list_head, &adap->device_list); diff --git a/linux/drivers/media/dvb/dvb-core/dvbdev.h b/linux/drivers/media/dvb/dvb-core/dvbdev.h index dca49cf96..79927305e 100644 --- a/linux/drivers/media/dvb/dvb-core/dvbdev.h +++ b/linux/drivers/media/dvb/dvb-core/dvbdev.h @@ -71,7 +71,7 @@ struct dvb_adapter { struct dvb_device { struct list_head list_head; - struct file_operations *fops; + const struct file_operations *fops; struct dvb_adapter *adapter; int type; int minor; -- cgit v1.2.3