leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[media] xc5000: fix memory corruption when unplugging device

Browse Source 
This patch addresses a regression introduced in the following patch:

commit 5264a522a5
Author: Shuah Khan <shuahkh@osg.samsung.com>
    [media] media: tuner xc5000 - release firmwware from xc5000_release()

The "priv" struct is actually reference counted, so the xc5000_release()
function gets called multiple times for hybrid devices.  Because
release_firmware() was always being called, it would work fine as expected
on the first call but then the second call would corrupt aribtrary memory.

Set the pointer to NULL after releasing so that we don't call
release_firmware() twice.

This problem was detected in the HVR-950q where plugging/unplugging the
device multiple times would intermittently show panics in completely
unrelated areas of the kernel.

Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com>
Cc: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This commit is contained in:
Devin Heitmueller 2014-09-22 21:30:46 -03:00 committed by Mauro Carvalho Chehab
parent 09bf4a858d
commit 856260a57c
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/media/tuners/xc5000.c
View File

@ -1336,7 +1336,10 @@ static int xc5000_release(struct dvb_frontend *fe)
if (priv) {
cancel_delayed_work(&priv->timer_sleep);
release_firmware(priv->firmware);
if (priv->firmware) {
release_firmware(priv->firmware);
priv->firmware = NULL;
}
hybrid_tuner_release_state(priv);
}