rc-core: race condition during ir_raw_event_register()
authorSean Young <sean@mess.org>
Wed, 24 May 2017 09:24:51 +0000 (06:24 -0300)
committerBen Hutchings <ben@decadent.org.uk>
Fri, 15 Sep 2017 17:30:50 +0000 (18:30 +0100)
commitbd33f9f3f4a8df2e4a6de42a606151bd0bd13d80
tree640f0adee4ba262feb2d52fc6674c05777f9d615
parentfff508b0d4ed9b75b72850795f52c06b72bc3c9d
rc-core: race condition during ir_raw_event_register()

commit 963761a0b2e85663ee4a5630f72930885a06598a upstream.

A rc device can call ir_raw_event_handle() after rc_allocate_device(),
but before rc_register_device() has completed. This is racey because
rcdev->raw is set before rcdev->raw->thread has a valid value.

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[bwh: Backported to 3.2: adjust filename, context, indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/media/rc/ir-raw.c