diff options
| author | Oliver Neukum <oneukum@suse.com> | 2019-04-30 09:07:36 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-07-26 09:10:12 +0200 |
| commit | 3b6503a21e62feb848f88df8cf183ea5be28afa8 (patch) | |
| tree | c2c2e39b18748bb0e08cf18b7e7be1bced5c372f /drivers/media/usb | |
| parent | 0a9f543d24cc42fb3c5eb5082fa6a53563c8adf6 (diff) | |
| download | linux-stable-3b6503a21e62feb848f88df8cf183ea5be28afa8.tar.gz linux-stable-3b6503a21e62feb848f88df8cf183ea5be28afa8.tar.bz2 linux-stable-3b6503a21e62feb848f88df8cf183ea5be28afa8.zip | |
media: dvb: usb: fix use after free in dvb_usb_device_exit
[ Upstream commit 6cf97230cd5f36b7665099083272595c55d72be7 ]
dvb_usb_device_exit() frees and uses the device name in that order.
Fix by storing the name in a buffer before freeing it.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+26ec41e9f788b3eba396@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media/usb')
| -rw-r--r-- | drivers/media/usb/dvb-usb/dvb-usb-init.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index e97f6edc98de..65f2b1a20ca1 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -284,12 +284,15 @@ EXPORT_SYMBOL(dvb_usb_device_init); void dvb_usb_device_exit(struct usb_interface *intf) { struct dvb_usb_device *d = usb_get_intfdata(intf); - const char *name = "generic DVB-USB module"; + const char *default_name = "generic DVB-USB module"; + char name[40]; usb_set_intfdata(intf, NULL); if (d != NULL && d->desc != NULL) { - name = d->desc->name; + strscpy(name, d->desc->name, sizeof(name)); dvb_usb_exit(d); + } else { + strscpy(name, default_name, sizeof(name)); } info("%s successfully deinitialized and disconnected.", name); |