@@ -61,6 +61,9 @@ struct as102_dev_t {
/* timer handle to trig ts stream download */
struct timer_list timer_handle;
+ /* used to reset private data on device release */
+ struct file *file;
+
struct mutex sem;
dma_addr_t dma_addr;
void *stream;
@@ -304,6 +304,8 @@ static void as102_usb_release(struct kref *kref)
as102_dev = container_of(kref, struct as102_dev_t, kref);
usb_put_dev(as102_dev->bus_adap.usb_dev);
+ if (as102_dev->file)
+ as102_dev->file->private_data = NULL;
kfree(as102_dev);
}
@@ -439,6 +441,9 @@ static int as102_open(struct inode *inode, struct file *file)
/* save our device object in the file's private structure */
file->private_data = dev;
+ /* save file's pointer to reset private data on release */
+ dev->file = file;
+
/* increment our usage count for the device */
kref_get(&dev->kref);
In case of successful 'as102_open()', store 'struct file' pointer in 'struct as102_dev_t' data to ensure that file's private data is reset to NULL after device removal via 'as102_usb_release()'. Leaving private data dangling may be the reason of things like https://syzkaller.appspot.com/bug?extid=47321e8fd5a4c84088db. Since there is no reproducer, mark this as compile tested only. Fixes: 41b44e041811 ("[media] staging: as102: Initial import from Abilis") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> --- drivers/media/usb/as102/as102_drv.h | 3 +++ drivers/media/usb/as102/as102_usb_drv.c | 5 +++++ 2 files changed, 8 insertions(+)