android_kernel_google_msm/drivers/isdn
Paul Bolle 17fd6bbdac ser_gigaset: use container_of() instead of detour
commit 8d2c3ab4445640957d136caa3629857d63544a2a upstream.

The purpose of gigaset_device_release() is to kfree() the struct
ser_cardstate that contains our struct device. This is done via a bit of
a detour. First we make our struct device's driver_data point to the
container of our struct ser_cardstate (which is a struct cardstate). In
gigaset_device_release() we then retrieve that driver_data again. And
after that we finally kfree() the struct ser_cardstate that was saved in
the struct cardstate.

All of this can be achieved much easier by using container_of() to get
from our struct device to its container, struct ser_cardstate. Do so.

Note that at the time the detour was implemented commit b8b2c7d845d5
("base/platform: assert that dev_pm_domain callbacks are called
unconditionally") had just entered the tree. That commit disconnected
our platform_device and our platform_driver. These were reconnected
again in v4.5-rc2 through commit 25cad69f21f5 ("base/platform: Fix
platform drivers with no probe callback"). And one of the consequences
of that fix was that it broke the detour via driver_data. That's because
it made __device_release_driver() stop being a NOP for our struct device
and actually do stuff again. One of the things it now does, is setting
our driver_data to NULL. That, in turn, makes it impossible for
gigaset_device_release() to get to our struct cardstate. Which has the
net effect of leaking a struct ser_cardstate at every call of this
driver's tty close() operation. So using container_of() has the
additional benefit of actually working.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Acked-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Zefan Li <lizefan@huawei.com>
2016-10-26 23:15:46 +08:00
..
act2000
capi
divert
gigaset ser_gigaset: use container_of() instead of detour 2016-10-26 23:15:46 +08:00
hardware mISDN: fix a loop count 2016-10-26 23:15:38 +08:00
hisax
hysdn
i4l ppp, slip: Validate VJ compression slot parameters completely 2016-03-21 09:17:54 +08:00
icn
isdnloop isdnloop: several buffer overflows 2014-04-26 17:13:18 -07:00
mISDN net: rework recvmsg handler msg_name and msg_namelen logic 2013-12-08 07:29:41 -08:00
pcbit
sc
Kconfig
Makefile