diff mbox

[6/6] drivers/media/dvb-usb-dvb: postpone kfree(mdev)

Message ID 145856704399.21117.3101229059196500883.stgit@woodpecker.blarg.de (mailing list archive)
State New, archived
Headers show

Commit Message

Max Kellermann March 21, 2016, 1:30 p.m. UTC 
Fixes use-after-free bug which occurs when I disconnect my DVB-S
received while VDR is running.

Signed-off-by: Max Kellermann <max@duempel.org>
---
 drivers/media/usb/dvb-usb/dvb-usb-dvb.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)


--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

kernel test robot March 21, 2016, 1:45 p.m. UTC | #1 
Hi Max,

[auto build test ERROR on v4.5-rc7]
[cannot apply to sailus-media/master linuxtv-media/master next-20160321]
[if your patch is applied to the wrong git tree, please drop us a note to help improving the system]

url:    https://github.com/0day-ci/linux/commits/Max-Kellermann/drivers-media-dvb-core-en50221-move-code-to-dvb_ca_private_free/20160321-213556
config: x86_64-randconfig-x000-201612 (attached as .config)
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All errors (new ones prefixed by >>):

   drivers/media/usb/dvb-usb/dvb-usb-dvb.c: In function 'dvb_usb_media_device_release':
>> drivers/media/usb/dvb-usb/dvb-usb-dvb.c:100:2: error: implicit declaration of function 'media_device_cleanup' [-Werror=implicit-function-declaration]
     media_device_cleanup(mdev);
     ^
   drivers/media/usb/dvb-usb/dvb-usb-dvb.c: At top level:
   drivers/media/usb/dvb-usb/dvb-usb-dvb.c:98:13: warning: 'dvb_usb_media_device_release' defined but not used [-Wunused-function]
    static void dvb_usb_media_device_release(struct media_device *mdev)
                ^
   In file included from include/uapi/linux/stddef.h:1:0,
                    from include/linux/stddef.h:4,
                    from include/uapi/linux/posix_types.h:4,
                    from include/uapi/linux/types.h:13,
                    from include/linux/types.h:5,
                    from include/uapi/linux/sysinfo.h:4,
                    from include/uapi/linux/kernel.h:4,
                    from include/linux/cache.h:4,
                    from include/linux/time.h:4,
                    from include/linux/input.h:11,
                    from drivers/media/usb/dvb-usb/dvb-usb.h:13,
                    from drivers/media/usb/dvb-usb/dvb-usb-common.h:12,
                    from drivers/media/usb/dvb-usb/dvb-usb-dvb.c:9:
   drivers/media/usb/dvb-usb/dvb-usb-dvb.c: In function 'dvb_usb_adapter_frontend_init':
   include/linux/compiler.h:147:6: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized]
     if (__builtin_constant_p(!!(cond)) ? !!(cond) :   \
         ^
   drivers/media/usb/dvb-usb/dvb-usb-dvb.c:289:6: note: 'ret' was declared here
     int ret, i;
         ^
   cc1: some warnings being treated as errors

vim +/media_device_cleanup +100 drivers/media/usb/dvb-usb/dvb-usb-dvb.c

    94		deb_ts("stop pid: 0x%04x, feedtype: %d\n", dvbdmxfeed->pid, dvbdmxfeed->type);
    95		return dvb_usb_ctrl_feed(dvbdmxfeed, 0);
    96	}
    97	
    98	static void dvb_usb_media_device_release(struct media_device *mdev)
    99	{
 > 100		media_device_cleanup(mdev);
   101		kfree(mdev);
   102	}
   103	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation
kernel test robot March 21, 2016, 1:56 p.m. UTC | #2 
Hi Max,

[auto build test WARNING on v4.5-rc7]
[cannot apply to sailus-media/master linuxtv-media/master next-20160321]
[if your patch is applied to the wrong git tree, please drop us a note to help improving the system]

url:    https://github.com/0day-ci/linux/commits/Max-Kellermann/drivers-media-dvb-core-en50221-move-code-to-dvb_ca_private_free/20160321-213556
config: xtensa-allyesconfig (attached as .config)
reproduce:
        wget https://git.kernel.org/cgit/linux/kernel/git/wfg/lkp-tests.git/plain/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        make.cross ARCH=xtensa 

All warnings (new ones prefixed by >>):

   drivers/media/usb/dvb-usb/dvb-usb-dvb.c: In function 'dvb_usb_media_device_unregister':
>> drivers/media/usb/dvb-usb/dvb-usb-dvb.c:148:2: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
     struct media_device *mdev = adap->dvb_adap.mdev;
     ^

vim +148 drivers/media/usb/dvb-usb/dvb-usb-dvb.c

   132	
   133	static int  dvb_usb_media_device_register(struct dvb_usb_adapter *adap)
   134	{
   135	#ifdef CONFIG_MEDIA_CONTROLLER_DVB
   136		return media_device_register(adap->dvb_adap.mdev);
   137	#else
   138		return 0;
   139	#endif
   140	}
   141	
   142	static void dvb_usb_media_device_unregister(struct dvb_usb_adapter *adap)
   143	{
   144	#ifdef CONFIG_MEDIA_CONTROLLER_DVB
   145		if (!adap->dvb_adap.mdev)
   146			return;
   147	
 > 148		struct media_device *mdev = adap->dvb_adap.mdev;
   149		adap->dvb_adap.mdev = NULL;
   150		media_device_unregister(mdev);
   151		/* media_device_cleanup() and kfree() will be called by the
   152		   callback function dvb_usb_media_device_release() */
   153	#endif
   154	}
   155	
   156	int dvb_usb_adapter_dvb_init(struct dvb_usb_adapter *adap, short *adapter_nums)

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation
diff mbox

Patch

diff --git a/drivers/media/usb/dvb-usb/dvb-usb-dvb.c b/drivers/media/usb/dvb-usb/dvb-usb-dvb.c
index 9ddfcab..7859479 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-dvb.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-dvb.c
@@ -95,6 +95,12 @@  static int dvb_usb_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
 	return dvb_usb_ctrl_feed(dvbdmxfeed, 0);
 }
 
+static void dvb_usb_media_device_release(struct media_device *mdev)
+{
+	media_device_cleanup(mdev);
+	kfree(mdev);
+}
+
 static int dvb_usb_media_device_init(struct dvb_usb_adapter *adap)
 {
 #ifdef CONFIG_MEDIA_CONTROLLER_DVB
@@ -113,6 +119,7 @@  static int dvb_usb_media_device_init(struct dvb_usb_adapter *adap)
 	strcpy(mdev->bus_info, udev->devpath);
 	mdev->hw_revision = le16_to_cpu(udev->descriptor.bcdDevice);
 	mdev->driver_version = LINUX_VERSION_CODE;
+	mdev->release = dvb_usb_media_device_release;
 
 	media_device_init(mdev);
 
@@ -138,10 +145,11 @@  static void dvb_usb_media_device_unregister(struct dvb_usb_adapter *adap)
 	if (!adap->dvb_adap.mdev)
 		return;
 
-	media_device_unregister(adap->dvb_adap.mdev);
-	media_device_cleanup(adap->dvb_adap.mdev);
-	kfree(adap->dvb_adap.mdev);
+	struct media_device *mdev = adap->dvb_adap.mdev;
 	adap->dvb_adap.mdev = NULL;
+	media_device_unregister(mdev);
+	/* media_device_cleanup() and kfree() will be called by the
+	   callback function dvb_usb_media_device_release() */
 #endif
 }