leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
412b16d623
linux/drivers/media
History
Matthias Schwarzott 412b16d623 media: cx23885: Fix use-after-free when unregistering the i2c_client for the dvb demod 
Unregistering the i2c_client of the demod driver destroys the frontend
object.
Calling vb2_dvb_unregister_bus later accesses the frontend (and with the
refcount_t) conversion the refcount_t code complains:

kernel: ------------[ cut here ]------------
kernel: WARNING: CPU: 0 PID: 7883 at lib/refcount.c:128 refcount_sub_and_test+0x70/0x80
kernel: refcount_t: underflow; use-after-free.
kernel: Modules linked in: bluetooth si2165(O) a8293(O) tda10071(O) tea5767(O) tuner(O) cx23885(O-) tda18271(O) videobuf2_dvb(O) videobuf2_dma_sg(O) m88ds3103(O) tveeprom(O) cx2341x(O) v4l2_common(O) dvb_core(O) rc_core(O) videobuf2_memops(O) videobuf2_v4l2(O) ums_realtek videobuf2_core(O) uas videodev(O) media(O) rtl8192cu i2c_mux usb_storage rtl_usb rtl8192c_common rtlwifi snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core x86_pkg_temp_thermal kvm_intel kvm irqbypass
kernel: CPU: 0 PID: 7883 Comm: rmmod Tainted: G        W  O    4.11.3-gentoo #3
kernel: Hardware name: MEDION E2050 2391/H81H3-EM2, BIOS H81EM2W08.308 08/25/2014
kernel: Call Trace:
kernel:  dump_stack+0x4d/0x66
kernel:  __warn+0xc6/0xe0
kernel:  warn_slowpath_fmt+0x46/0x50
kernel:  ? kobject_put+0x2f/0x60
kernel:  refcount_sub_and_test+0x70/0x80
kernel:  refcount_dec_and_test+0x11/0x20
kernel:  dvb_unregister_frontend+0x42/0x60 [dvb_core]
kernel:  vb2_dvb_dealloc_frontends+0x9e/0x100 [videobuf2_dvb]
kernel:  vb2_dvb_unregister_bus+0xd/0x20 [videobuf2_dvb]
kernel:  cx23885_dvb_unregister+0xc3/0x110 [cx23885]
kernel:  cx23885_dev_unregister+0xea/0x150 [cx23885]
kernel:  cx23885_finidev+0x4f/0x70 [cx23885]
kernel:  pci_device_remove+0x34/0xb0
kernel:  device_release_driver_internal+0x150/0x200
kernel:  driver_detach+0x33/0x70
kernel:  bus_remove_driver+0x47/0xa0
kernel:  driver_unregister+0x27/0x50
kernel:  pci_unregister_driver+0x34/0x90
kernel:  cx23885_fini+0x10/0x12 [cx23885]
kernel:  SyS_delete_module+0x166/0x220
kernel:  ? exit_to_usermode_loop+0x7b/0x80
kernel:  entry_SYSCALL_64_fastpath+0x17/0x98
kernel: RIP: 0033:0x7f5901680b07
kernel: RSP: 002b:00007ffdf6cdb028 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
kernel: RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5901680b07
kernel: RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000000001500258
kernel: RBP: 00000000015001f0 R08: 0000000000000000 R09: 1999999999999999
kernel: R10: 0000000000000884 R11: 0000000000000206 R12: 00007ffdf6cda010
kernel: R13: 0000000000000000 R14: 00000000015001f0 R15: 00000000014ff010
kernel: ---[ end trace c3a4659b89086061 ]---

Signed-off-by: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:32:54 -04:00
..
cec media: cec: replace pin->cur_value by adap->cec_pin_is_high 2017-08-26 08:35:10 -04:00
common media: saa7146: constify videobuf_queue_ops structures 2017-08-26 14:29:51 -04:00
dvb-core media: dvb-core/demux.h: fix kernel-doc warning 2017-07-21 08:01:08 -04:00
dvb-frontends media: isl6421: add checks for current overflow 2017-08-20 10:20:30 -04:00
firewire [media] firewire: don't break long lines 2016-10-21 10:06:00 -02:00
i2c media: smiapp: check memory allocation failure 2017-08-26 20:15:13 -04:00
mmc
pci media: cx23885: Fix use-after-free when unregistering the i2c_client for the dvb demod 2017-08-27 06:32:54 -04:00
platform media: omap3isp: fix uninitialized variable use 2017-08-26 20:14:42 -04:00
radio media: radio-usb-si4713: make i2c_adapter const 2017-08-26 08:41:29 -04:00
rc media: rc: rename RC_TYPE_* to RC_PROTO_* and RC_BIT_* to RC_PROTO_BIT_* 2017-08-20 10:02:48 -04:00
spi [media] gs1662: drop kfree for memory allocated with devm_kzalloc 2016-10-24 17:59:08 -02:00
tuners media: tuners: make snd_pcm_hardware const 2017-08-20 08:05:25 -04:00
usb media: em28xx: calculate left volume level correctly 2017-08-26 14:31:49 -04:00
v4l2-core media: v4l2-flash-led-class: Create separate sub-devices for indicators 2017-08-26 20:26:35 -04:00
Kconfig media: rc-core: do not depend on MEDIA_SUPPORT 2017-08-20 09:39:36 -04:00
Makefile [media] cec: select CEC_CORE instead of depend on it 2017-06-04 15:23:33 -03:00
media-device.c media: drop use of MEDIA_API_VERSION 2017-08-08 06:03:15 -04:00
media-devnode.c media: utilize new cdev_device_add helper function 2017-03-21 06:44:33 +01:00
media-entity.c media: Make parameter of media_entity_remote_pad() const 2017-07-20 16:54:04 -04:00