leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[media] s2255: Do not free fw_data until timer handler has actually stopped using it

Browse Source 
Function del_timer() does not guarantee that timer was really deleted.
If the timer handler is beeing executed at the moment, the function
does nothing. So, we have a race between del_timer() and kfree(), and
it's possible to use already freed memory in the handler.

Signed-off-by: Kirill Tkhai <tkhai@yandex.ru>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This commit is contained in:
Kirill Tkhai 2014-04-17 17:47:04 -03:00 committed by Mauro Carvalho Chehab
parent cd6ff5c2df
commit 9f6be2bc40
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/media/usb/s2255/s2255drv.c
View File

@ -1521,7 +1521,7 @@ static void s2255_destroy(struct s2255_dev *dev)
/* board shutdown stops the read pipe if it is running */ /* board shutdown stops the read pipe if it is running */
s2255_board_shutdown(dev); s2255_board_shutdown(dev);
/* make sure firmware still not trying to load */ /* make sure firmware still not trying to load */
del_timer(&dev->timer); /* only started in .probe and .open */ del_timer_sync(&dev->timer); /* only started in .probe and .open */
if (dev->fw_data->fw_urb) { if (dev->fw_data->fw_urb) {
usb_kill_urb(dev->fw_data->fw_urb); usb_kill_urb(dev->fw_data->fw_urb);
usb_free_urb(dev->fw_data->fw_urb); usb_free_urb(dev->fw_data->fw_urb);
@ -2351,7 +2351,7 @@ errorREQFW:
errorFWDATA2: errorFWDATA2:
usb_free_urb(dev->fw_data->fw_urb); usb_free_urb(dev->fw_data->fw_urb);
errorFWURB: errorFWURB:
del_timer(&dev->timer); del_timer_sync(&dev->timer);
errorEP: errorEP:
usb_put_dev(dev->udev); usb_put_dev(dev->udev);
errorUDEV: errorUDEV: