[media] lirc: use-after free while reading from device and unplugging

Many lirc drivers have their own receive buffers which are freed on
unplug (e.g. ir_lirc_unregister). This means that ir->buf->wait_poll
will be freed directly after unplug so do not remove yourself from the
wait queue.

Signed-off-by: Sean Young <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>

diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 7215891da2485ed7aebadc4652cd05e110ae1737..d3039efb4e7cf0db00bb09868d11ba615ba973b3 100644 (file)
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -715,7 +715,7 @@ ssize_t lirc_dev_fop_read(struct file *file,
 
                        if (!ir->attached) {
                                ret = -ENODEV;
-                               break;
+                               goto out_locked;
                        }
                } else {
                        lirc_buffer_read(ir->buf, buf);