rfkill: copy the name into the rfkill struct
commit b7bb110008607a915298bf0f47d25886ecb94477 upstream. Some users of rfkill, like NFC and cfg80211, use a dynamic name when allocating rfkill, in those cases dev_name(). Therefore, the pointer passed to rfkill_alloc() might not be valid forever, I specifically found the case that the rfkill name was quite obviously an invalid pointer (or at least garbage) when the wiphy had been renamed. Fix this by making a copy of the rfkill name in rfkill_alloc(). Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
9cec788323
commit
ffb785e178
|
@ -51,7 +51,6 @@
|
|||
struct rfkill {
|
||||
spinlock_t lock;
|
||||
|
||||
const char *name;
|
||||
enum rfkill_type type;
|
||||
|
||||
unsigned long state;
|
||||
|
@ -75,6 +74,7 @@ struct rfkill {
|
|||
struct delayed_work poll_work;
|
||||
struct work_struct uevent_work;
|
||||
struct work_struct sync_work;
|
||||
char name[];
|
||||
};
|
||||
#define to_rfkill(d) container_of(d, struct rfkill, dev)
|
||||
|
||||
|
@ -871,14 +871,14 @@ struct rfkill * __must_check rfkill_alloc(const char *name,
|
|||
if (WARN_ON(type == RFKILL_TYPE_ALL || type >= NUM_RFKILL_TYPES))
|
||||
return NULL;
|
||||
|
||||
rfkill = kzalloc(sizeof(*rfkill), GFP_KERNEL);
|
||||
rfkill = kzalloc(sizeof(*rfkill) + strlen(name) + 1, GFP_KERNEL);
|
||||
if (!rfkill)
|
||||
return NULL;
|
||||
|
||||
spin_lock_init(&rfkill->lock);
|
||||
INIT_LIST_HEAD(&rfkill->node);
|
||||
rfkill->type = type;
|
||||
rfkill->name = name;
|
||||
strcpy(rfkill->name, name);
|
||||
rfkill->ops = ops;
|
||||
rfkill->data = ops_data;
|
||||
|
||||
|
|
Loading…
Reference in New Issue