f41ced8f10
Several subsystem open handlers dereference the fops_get() return value without checking it for nullness. This opens a race condition between the open handler and module unloading. A module can be marked as being unloaded (MODULE_STATE_GOING) before its exit function is called and gets the chance to unregister the driver. During that window open handlers can still be called, and fops_get() will fail in try_module_get() and return a NULL pointer. This change checks the fops_get() return value and returns -ENODEV if NULL. Reported-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk> Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be> Acked-by: Takashi Iwai <tiwai@suse.de> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Dave Airlie <airlied@linux.ie> Acked-by: Mauro Carvalho Chehab <mchehab@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
---|---|---|
.. | ||
accessibility | ||
acpi | ||
amba | ||
ata | ||
atm | ||
auxdisplay | ||
base | ||
block | ||
bluetooth | ||
cdrom | ||
char | ||
clocksource | ||
connector | ||
cpufreq | ||
cpuidle | ||
crypto | ||
dca | ||
dio | ||
dma | ||
edac | ||
eisa | ||
firewire | ||
firmware | ||
gpio | ||
gpu | ||
hid | ||
hwmon | ||
i2c | ||
ide | ||
idle | ||
ieee1394 | ||
infiniband | ||
input | ||
isdn | ||
leds | ||
lguest | ||
macintosh | ||
mca | ||
md | ||
media | ||
memstick | ||
message | ||
mfd | ||
misc | ||
mmc | ||
mtd | ||
net | ||
nubus | ||
of | ||
oprofile | ||
parisc | ||
parport | ||
pci | ||
pcmcia | ||
pnp | ||
power | ||
ps3 | ||
rapidio | ||
regulator | ||
rtc | ||
s390 | ||
sbus | ||
scsi | ||
serial | ||
sh | ||
sn | ||
spi | ||
ssb | ||
staging | ||
tc | ||
telephony | ||
thermal | ||
uio | ||
usb | ||
uwb | ||
video | ||
virtio | ||
w1 | ||
watchdog | ||
xen | ||
zorro | ||
Kconfig | ||
Makefile |