media: dvbsky: Avoid leaking dvb frontend - linux-dev - Linux kernel development work

diff options

author	Stefan Brüns <stefan.bruens@rwth-aachen.de>	2019-01-19 20:30:04 -0500
committer	Mauro Carvalho Chehab <mchehab+samsung@kernel.org>	2019-03-19 16:42:24 -0400
commit	fdfa59cd63b184e1e96d51ff170fcac739bc6f6f (patch)
tree	b50e3935a7bfa0415a93c895d7e386da11d042ca /tools/perf/scripts/python/bin/syscall-counts-record
parent	media: wl128x: Fix an error code in fm_download_firmware() (diff)

media: dvbsky: Avoid leaking dvb frontend

Commit 14f4eaeddabc ("media: dvbsky: fix driver unregister logic") fixed a use-after-free by removing the reference to the frontend after deleting the backing i2c device. This has the unfortunate side effect the frontend device is never freed in the dvb core leaving a dangling device, leading to errors when the dvb core tries to register the frontend after e.g. a replug as reported here: https://www.spinics.net/lists/linux-media/msg138181.html media: dvbsky: issues with DVBSky T680CI === [ 561.119145] sp2 8-0040: CIMaX SP2 successfully attached [ 561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs Si2168)... [ 561.119174] sysfs: cannot create duplicate filename '/class/dvb/ dvb0.frontend0' === The use after free happened as dvb_usbv2_disconnect calls in this order: - dvb_usb_device::props->exit(...) - dvb_usbv2_adapter_frontend_exit(...) + if (fe) dvb_unregister_frontend(fe) + dvb_usb_device::props->frontend_detach(...) Moving the release of the i2c device from exit() to frontend_detach() avoids the dangling pointer access and allows the core to unregister the frontend. This was originally reported for a DVBSky T680CI, but it also affects the MyGica T230C. As all supported devices structure the registration/ unregistration identically, apply the change for all device types. Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

Diffstat (limited to 'tools/perf/scripts/python/bin/syscall-counts-record')

0 files changed, 0 insertions, 0 deletions

/* setjmp for ARM. Copyright (C) 1997-2022 Free Software Foundation, Inc. This file is part of the GNU C Library. The GNU C Library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. The GNU C Library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with the GNU C Library. If not, see <https://www.gnu.org/licenses/>. */ #include <sysdep.h> #include <pointer_guard.h> #include <stap-probe.h> #include <bits/setjmp.h> #include <rtld-global-offsets.h> #include <arm-features.h> ENTRY (__sigsetjmp) #ifdef PTR_MANGLE PTR_MANGLE_LOAD (a3, ip) #endif mov ip, r0 /* setjmp probe expects sigsetjmp first argument (4@r0), second argument (-4@r1), and target address (4@r14), respectively. */ LIBC_PROBE (setjmp, 3, 4@r0, -4@r1, 4@r14) /* Save sp and lr */ #ifdef PTR_MANGLE mov a4, sp PTR_MANGLE2 (a4, a4, a3) str a4, [ip], #4 PTR_MANGLE2 (a4, lr, a3) str a4, [ip], #4 #else str sp, [ip], #4 str lr, [ip], #4 #endif /* Save registers */ stmia ip!, JMP_BUF_REGLIST #if !defined ARM_ASSUME_NO_IWMMXT || defined __SOFTFP__ # define NEED_HWCAP 1 #endif #ifdef NEED_HWCAP /* Check if we have a VFP unit. */ # if IS_IN (rtld) LDST_PCREL (ldr, a3, a4, \ C_SYMBOL_NAME(_rtld_local_ro) \ + RTLD_GLOBAL_RO_DL_HWCAP_OFFSET) # else # ifdef SHARED LDR_GLOBAL (a3, a4, C_SYMBOL_NAME(_rtld_global_ro), \ RTLD_GLOBAL_RO_DL_HWCAP_OFFSET) # else LDR_GLOBAL (a3, a4, C_SYMBOL_NAME(_dl_hwcap), 0) # endif # endif #endif #ifdef __SOFTFP__ tst a3, #HWCAP_ARM_VFP beq .Lno_vfp #endif /* Store the VFP registers. Don't use VFP instructions directly because this code is used in non-VFP multilibs. */ /* Following instruction is vstmia ip!, {d8-d15}. */ stc p11, cr8, [ip], #64 .Lno_vfp: #ifndef ARM_ASSUME_NO_IWMMXT tst a3, #HWCAP_ARM_IWMMXT beq .Lno_iwmmxt /* Save the call-preserved iWMMXt registers. */ /* Following instructions are wstrd wr10, [ip], #8 (etc.) */ stcl p1, cr10, [r12], #8 stcl p1, cr11, [r12], #8 stcl p1, cr12, [r12], #8 stcl p1, cr13, [r12], #8 stcl p1, cr14, [r12], #8 stcl p1, cr15, [r12], #8 .Lno_iwmmxt: #endif /* Make a tail call to __sigjmp_save; it takes the same args. */ B PLTJMP(C_SYMBOL_NAME(__sigjmp_save)) END (__sigsetjmp) hidden_def (__sigsetjmp)


context:
space:
mode: