• L
    iio: Fix potential use after free · e407fd65
    Lars-Peter Clausen 提交于
    There is no guarantee that the last reference to the iio device has already been
    dropped when iio_device_free is called. This means that we can up calling
    iio_dev_release after iio_device_free which will lead to a use after free. As
    the general rule the struct containing the device should always be freed in the
    release callback.
    
    This is what this patch does, it moves freeing the iio device struct as well as
    releasing the idr reference to the release callback. To ensure that the device
    is not freed before calling iio_device_free the device_unregister call in
    iio_device_unregister is broken apart. iio_device_unregister will now only call
    device_del to remove the device from the system and iio_device_free will call
    put_device to drop the reference we obtained in iio_devce_alloc.
    
    We also have to take care that calling iio_device_free without having called
    iio_device_register still works (i.e. this can happen if something failed during
    device initialization). For this to work properly two minor changes were
    necessary: channel_attr_list needs to be initialized in iio_device_alloc and we
    have to check whether the chrdev has been registered before releasing it in
    iio_device_release.
    
    This change also brings iio_device_unregister and iio_device_free more in sync
    with iio_device_register and iio_device_alloc which call device_add and
    device_initialize respectively.
    Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
    Acked-by: NJonathan Cameron <jic23@kernel.org>
    Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    e407fd65
industrialio-core.c 22.1 KB