From patchwork Tue Dec 15 10:08:39 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 7853151 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 764E8BEEE1 for ; Tue, 15 Dec 2015 10:10:11 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 7D90C202EC for ; Tue, 15 Dec 2015 10:10:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 10BAD2025B for ; Tue, 15 Dec 2015 10:10:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964879AbbLOKKE (ORCPT ); Tue, 15 Dec 2015 05:10:04 -0500 Received: from bombadil.infradead.org ([198.137.202.9]:43742 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S964899AbbLOKKC (ORCPT ); Tue, 15 Dec 2015 05:10:02 -0500 Received: from [191.33.142.179] (helo=smtp.w2.samsung.com) by bombadil.infradead.org with esmtpsa (Exim 4.80.1 #2 (Red Hat Linux)) id 1a8mYT-0000LY-HV; Tue, 15 Dec 2015 10:10:01 +0000 Received: from mchehab by smtp.w2.samsung.com with local (Exim 4.86) (envelope-from ) id 1a8mYD-0007x4-5S; Tue, 15 Dec 2015 08:09:45 -0200 From: Mauro Carvalho Chehab Cc: Mauro Carvalho Chehab , Linux Media Mailing List , Mauro Carvalho Chehab Subject: [PATCH 2/2] [media] media-entity: cache media_device on object removal Date: Tue, 15 Dec 2015 08:08:39 -0200 Message-Id: <7d1e683caa38c62f1801df3887f56147542077e6.1450174116.git.mchehab@osg.samsung.com> X-Mailer: git-send-email 2.5.0 In-Reply-To: <0a8b9468b9da5f5d4177446696a91ce4099354d0.1450174116.git.mchehab@osg.samsung.com> References: <0a8b9468b9da5f5d4177446696a91ce4099354d0.1450174116.git.mchehab@osg.samsung.com> In-Reply-To: <0a8b9468b9da5f5d4177446696a91ce4099354d0.1450174116.git.mchehab@osg.samsung.com> References: <0a8b9468b9da5f5d4177446696a91ce4099354d0.1450174116.git.mchehab@osg.samsung.com> To: unlisted-recipients:; (no To-header on input) Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP As pointed by Dan, the patch f8fd4c61b5ae: "[media] media-entity: protect object creation/removal using spin lock" leads to the following static checker warning: drivers/media/media-entity.c:781 media_remove_intf_link() error: dereferencing freed memory 'link' drivers/media/media-entity.c 777 void media_remove_intf_link(struct media_link *link) 778 { 779 spin_lock(&link->graph_obj.mdev->lock); 780 __media_remove_intf_link(link); 781 spin_unlock(&link->graph_obj.mdev->lock); In practice, I didn't see any troubles even with KASAN enabled. I guess gcc optimizer internally cached the mdev reference, instead of getting it twice. Yet, it is a very bad idea to rely on such optimization. So, let's fix the code. Reported-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/media-entity.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c index 29810f9b86ce..6c3f4041797c 100644 --- a/drivers/media/media-entity.c +++ b/drivers/media/media-entity.c @@ -580,13 +580,15 @@ EXPORT_SYMBOL_GPL(__media_entity_remove_links); void media_entity_remove_links(struct media_entity *entity) { + struct media_device *mdev = entity->graph_obj.mdev; + /* Do nothing if the entity is not registered. */ - if (entity->graph_obj.mdev == NULL) + if (mdev == NULL) return; - spin_lock(&entity->graph_obj.mdev->lock); + spin_lock(&mdev->lock); __media_entity_remove_links(entity); - spin_unlock(&entity->graph_obj.mdev->lock); + spin_unlock(&mdev->lock); } EXPORT_SYMBOL_GPL(media_entity_remove_links); @@ -781,9 +783,15 @@ EXPORT_SYMBOL_GPL(__media_remove_intf_link); void media_remove_intf_link(struct media_link *link) { - spin_lock(&link->graph_obj.mdev->lock); + struct media_device *mdev = link->graph_obj.mdev; + + /* Do nothing if the intf is not registered. */ + if (mdev == NULL) + return; + + spin_lock(&mdev->lock); __media_remove_intf_link(link); - spin_unlock(&link->graph_obj.mdev->lock); + spin_unlock(&mdev->lock); } EXPORT_SYMBOL_GPL(media_remove_intf_link); @@ -799,12 +807,14 @@ EXPORT_SYMBOL_GPL(__media_remove_intf_links); void media_remove_intf_links(struct media_interface *intf) { + struct media_device *mdev = intf->graph_obj.mdev; + /* Do nothing if the intf is not registered. */ - if (intf->graph_obj.mdev == NULL) + if (mdev == NULL) return; - spin_lock(&intf->graph_obj.mdev->lock); + spin_lock(&mdev->lock); __media_remove_intf_links(intf); - spin_unlock(&intf->graph_obj.mdev->lock); + spin_unlock(&mdev->lock); } EXPORT_SYMBOL_GPL(media_remove_intf_links);