mirror of
https://github.com/followmsi/android_kernel_google_msm.git
synced 2024-11-06 23:17:41 +00:00
rfkill: copy the name into the rfkill struct
commit b7bb110008607a915298bf0f47d25886ecb94477 upstream. Some users of rfkill, like NFC and cfg80211, use a dynamic name when allocating rfkill, in those cases dev_name(). Therefore, the pointer passed to rfkill_alloc() might not be valid forever, I specifically found the case that the rfkill name was quite obviously an invalid pointer (or at least garbage) when the wiphy had been renamed. Fix this by making a copy of the rfkill name in rfkill_alloc(). Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Zefan Li <lizefan@huawei.com>
This commit is contained in:
parent
c5596fe183
commit
322d37f032
1 changed files with 3 additions and 3 deletions
|
@ -51,7 +51,6 @@
|
|||
struct rfkill {
|
||||
spinlock_t lock;
|
||||
|
||||
const char *name;
|
||||
enum rfkill_type type;
|
||||
|
||||
unsigned long state;
|
||||
|
@ -75,6 +74,7 @@ struct rfkill {
|
|||
struct delayed_work poll_work;
|
||||
struct work_struct uevent_work;
|
||||
struct work_struct sync_work;
|
||||
char name[];
|
||||
};
|
||||
#define to_rfkill(d) container_of(d, struct rfkill, dev)
|
||||
|
||||
|
@ -849,14 +849,14 @@ struct rfkill * __must_check rfkill_alloc(const char *name,
|
|||
if (WARN_ON(type == RFKILL_TYPE_ALL || type >= NUM_RFKILL_TYPES))
|
||||
return NULL;
|
||||
|
||||
rfkill = kzalloc(sizeof(*rfkill), GFP_KERNEL);
|
||||
rfkill = kzalloc(sizeof(*rfkill) + strlen(name) + 1, GFP_KERNEL);
|
||||
if (!rfkill)
|
||||
return NULL;
|
||||
|
||||
spin_lock_init(&rfkill->lock);
|
||||
INIT_LIST_HEAD(&rfkill->node);
|
||||
rfkill->type = type;
|
||||
rfkill->name = name;
|
||||
strcpy(rfkill->name, name);
|
||||
rfkill->ops = ops;
|
||||
rfkill->data = ops_data;
|
||||
|
||||
|
|
Loading…
Reference in a new issue