tree 6cfa3f4ac4ef03bc7f7cc5fe4180a956f470213b
parent 163f1e93e995048b894c5fc86a6034d16beed740
author Mauro Carvalho Chehab <mchehab@osg.samsung.com> 1461796106 -0300
committer Mauro Carvalho Chehab <mchehab@s-opensource.com> 1466024244 -0300

[media] media-device: dynamically allocate struct media_devnode

struct media_devnode is currently embedded at struct media_device.

While this works fine during normal usage, it leads to a race
condition during devnode unregister. the problem is that drivers
assume that, after calling media_device_unregister(), the struct
that contains media_device can be freed. This is not true, as it
can't be freed until userspace closes all opened /dev/media devnodes.

In other words, if the media devnode is still open, and media_device
gets freed, any call to an ioctl will make the core to try to access
struct media_device, with will cause an use-after-free and even GPF.

Fix this by dynamically allocating the struct media_devnode and only
freeing it when it is safe.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>