barebox v2024.03.0 moves the reference count maintenance into
cdev_open/cdev_close, but missed to switch devfs_open and devfs_close to
actually use cdev_open/cdev_close. The result was that the cdev could be
deleted, e.g. due to partition reparsing, and further use of the file
descriptor would result in a use-after-free.
Fix this by doing what the commit introducing the breakage was purported
to do.
Fixes: d84c3daf1314 ("fs: move cdev open count to cdev_open()/cdev_close()")
Signed-off-by: Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx>
---
fs/devfs.c | 18 ++----------------
1 file changed, 2 insertions(+), 16 deletions(-)
diff --git a/fs/devfs.c b/fs/devfs.c
index c8ddbbdab04d..f5bad5aa9bf2 100644
--- a/fs/devfs.c
+++ b/fs/devfs.c
@@ -102,33 +102,19 @@ static int devfs_open(struct device *_dev, FILE *f, const char *filename)
struct inode *inode = f->f_inode;
struct devfs_inode *node = container_of(inode, struct devfs_inode, inode);
struct cdev *cdev = node->cdev;
- int ret;
f->size = cdev->flags & DEVFS_IS_CHARACTER_DEV ?
FILE_SIZE_STREAM : cdev->size;
f->priv = cdev;
- if (cdev->ops->open) {
- ret = cdev->ops->open(cdev, f->flags);
- if (ret)
- return ret;
- }
-
- return 0;
+ return cdev_open(cdev, f->flags);
}
static int devfs_close(struct device *_dev, FILE *f)
{
struct cdev *cdev = f->priv;
- int ret;
- if (cdev->ops->close) {
- ret = cdev->ops->close(cdev);
- if (ret)
- return ret;
- }
-
- return 0;
+ return cdev_close(cdev);
}
static int devfs_flush(struct device *_dev, FILE *f)
--
2.39.2
