From patchwork Tue Dec 15 10:11:47 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 7853191 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 75C24BEEE1 for ; Tue, 15 Dec 2015 10:12:01 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 92EEB202C8 for ; Tue, 15 Dec 2015 10:12:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9A80120357 for ; Tue, 15 Dec 2015 10:11:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965065AbbLOKLz (ORCPT ); Tue, 15 Dec 2015 05:11:55 -0500 Received: from lists.s-osg.org ([54.187.51.154]:51817 "EHLO lists.s-osg.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965016AbbLOKLw (ORCPT ); Tue, 15 Dec 2015 05:11:52 -0500 Received: from recife.lan (unknown [191.33.142.179]) by lists.s-osg.org (Postfix) with ESMTPSA id 0CF33462A3; Tue, 15 Dec 2015 02:11:50 -0800 (PST) Date: Tue, 15 Dec 2015 08:11:47 -0200 From: Mauro Carvalho Chehab To: Dan Carpenter , Linux Media Mailing List Subject: Fw: [PATCH 2/2] [media] media-entity: cache media_device on object removal Message-ID: <20151215081147.2a08e81a@recife.lan> Organization: Samsung X-Mailer: Claws Mail 3.12.0 (GTK+ 2.24.28; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hi Dan, This were supposed to be C/C to you. Thanks and Regards, Mauro Forwarded message: Date: Tue, 15 Dec 2015 08:08:39 -0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Linux Media Mailing List , Mauro Carvalho Chehab Subject: [PATCH 2/2] [media] media-entity: cache media_device on object removal As pointed by Dan, the patch f8fd4c61b5ae: "[media] media-entity: protect object creation/removal using spin lock" leads to the following static checker warning: drivers/media/media-entity.c:781 media_remove_intf_link() error: dereferencing freed memory 'link' drivers/media/media-entity.c 777 void media_remove_intf_link(struct media_link *link) 778 { 779 spin_lock(&link->graph_obj.mdev->lock); 780 __media_remove_intf_link(link); 781 spin_unlock(&link->graph_obj.mdev->lock); In practice, I didn't see any troubles even with KASAN enabled. I guess gcc optimizer internally cached the mdev reference, instead of getting it twice. Yet, it is a very bad idea to rely on such optimization. So, let's fix the code. Reported-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/media-entity.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c index 29810f9b86ce..6c3f4041797c 100644 --- a/drivers/media/media-entity.c +++ b/drivers/media/media-entity.c @@ -580,13 +580,15 @@ EXPORT_SYMBOL_GPL(__media_entity_remove_links); void media_entity_remove_links(struct media_entity *entity) { + struct media_device *mdev = entity->graph_obj.mdev; + /* Do nothing if the entity is not registered. */ - if (entity->graph_obj.mdev == NULL) + if (mdev == NULL) return; - spin_lock(&entity->graph_obj.mdev->lock); + spin_lock(&mdev->lock); __media_entity_remove_links(entity); - spin_unlock(&entity->graph_obj.mdev->lock); + spin_unlock(&mdev->lock); } EXPORT_SYMBOL_GPL(media_entity_remove_links); @@ -781,9 +783,15 @@ EXPORT_SYMBOL_GPL(__media_remove_intf_link); void media_remove_intf_link(struct media_link *link) { - spin_lock(&link->graph_obj.mdev->lock); + struct media_device *mdev = link->graph_obj.mdev; + + /* Do nothing if the intf is not registered. */ + if (mdev == NULL) + return; + + spin_lock(&mdev->lock); __media_remove_intf_link(link); - spin_unlock(&link->graph_obj.mdev->lock); + spin_unlock(&mdev->lock); } EXPORT_SYMBOL_GPL(media_remove_intf_link); @@ -799,12 +807,14 @@ EXPORT_SYMBOL_GPL(__media_remove_intf_links); void media_remove_intf_links(struct media_interface *intf) { + struct media_device *mdev = intf->graph_obj.mdev; + /* Do nothing if the intf is not registered. */ - if (intf->graph_obj.mdev == NULL) + if (mdev == NULL) return; - spin_lock(&intf->graph_obj.mdev->lock); + spin_lock(&mdev->lock); __media_remove_intf_links(intf); - spin_unlock(&intf->graph_obj.mdev->lock); + spin_unlock(&mdev->lock); } EXPORT_SYMBOL_GPL(media_remove_intf_links);