AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-21 07:09:15 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
412b16d623
linux_dsm_epyc7002/drivers/media/pci/cx23885
History
Matthias Schwarzott 412b16d623 media: cx23885: Fix use-after-free when unregistering the i2c_client for the dvb demod 
Unregistering the i2c_client of the demod driver destroys the frontend
object.
Calling vb2_dvb_unregister_bus later accesses the frontend (and with the
refcount_t) conversion the refcount_t code complains:

kernel: ------------[ cut here ]------------
kernel: WARNING: CPU: 0 PID: 7883 at lib/refcount.c:128 refcount_sub_and_test+0x70/0x80
kernel: refcount_t: underflow; use-after-free.
kernel: Modules linked in: bluetooth si2165(O) a8293(O) tda10071(O) tea5767(O) tuner(O) cx23885(O-) tda18271(O) videobuf2_dvb(O) videobuf2_dma_sg(O) m88ds3103(O) tveeprom(O) cx2341x(O) v4l2_common(O) dvb_core(O) rc_core(O) videobuf2_memops(O) videobuf2_v4l2(O) ums_realtek videobuf2_core(O) uas videodev(O) media(O) rtl8192cu i2c_mux usb_storage rtl_usb rtl8192c_common rtlwifi snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core x86_pkg_temp_thermal kvm_intel kvm irqbypass
kernel: CPU: 0 PID: 7883 Comm: rmmod Tainted: G        W  O    4.11.3-gentoo #3
kernel: Hardware name: MEDION E2050 2391/H81H3-EM2, BIOS H81EM2W08.308 08/25/2014
kernel: Call Trace:
kernel:  dump_stack+0x4d/0x66
kernel:  __warn+0xc6/0xe0
kernel:  warn_slowpath_fmt+0x46/0x50
kernel:  ? kobject_put+0x2f/0x60
kernel:  refcount_sub_and_test+0x70/0x80
kernel:  refcount_dec_and_test+0x11/0x20
kernel:  dvb_unregister_frontend+0x42/0x60 [dvb_core]
kernel:  vb2_dvb_dealloc_frontends+0x9e/0x100 [videobuf2_dvb]
kernel:  vb2_dvb_unregister_bus+0xd/0x20 [videobuf2_dvb]
kernel:  cx23885_dvb_unregister+0xc3/0x110 [cx23885]
kernel:  cx23885_dev_unregister+0xea/0x150 [cx23885]
kernel:  cx23885_finidev+0x4f/0x70 [cx23885]
kernel:  pci_device_remove+0x34/0xb0
kernel:  device_release_driver_internal+0x150/0x200
kernel:  driver_detach+0x33/0x70
kernel:  bus_remove_driver+0x47/0xa0
kernel:  driver_unregister+0x27/0x50
kernel:  pci_unregister_driver+0x34/0x90
kernel:  cx23885_fini+0x10/0x12 [cx23885]
kernel:  SyS_delete_module+0x166/0x220
kernel:  ? exit_to_usermode_loop+0x7b/0x80
kernel:  entry_SYSCALL_64_fastpath+0x17/0x98
kernel: RIP: 0033:0x7f5901680b07
kernel: RSP: 002b:00007ffdf6cdb028 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
kernel: RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f5901680b07
kernel: RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000000001500258
kernel: RBP: 00000000015001f0 R08: 0000000000000000 R09: 1999999999999999
kernel: R10: 0000000000000884 R11: 0000000000000206 R12: 00007ffdf6cda010
kernel: R13: 0000000000000000 R14: 00000000015001f0 R15: 00000000014ff010
kernel: ---[ end trace c3a4659b89086061 ]---

Signed-off-by: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:32:54 -04:00
..
altera-ci.c [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
altera-ci.h [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
cimax2.c [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
cimax2.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
cx23885-417.c media: cx23885: add const to v4l2_file_operations structure 2017-07-19 14:56:41 -04:00
cx23885-alsa.c media: pci: make snd_pcm_hardware const 2017-08-20 08:05:21 -04:00
cx23885-av.c [media] cx23885: uninitialized variable in cx23885_av_work_handler() 2016-04-13 17:10:32 -03:00
cx23885-av.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
cx23885-cards.c [media] media drivers: annotate fall-through 2017-05-19 07:10:03 -03:00
cx23885-core.c media: cx23885: constify pci_device_id 2017-08-09 09:44:06 -04:00
cx23885-dvb.c media: cx23885: Fix use-after-free when unregistering the i2c_client for the dvb demod 2017-08-27 06:32:54 -04:00
cx23885-f300.c [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
cx23885-f300.h [media] dvb: Get rid of typedev usage for enums 2015-06-09 17:47:35 -03:00
cx23885-i2c.c media: pci: make i2c_adapter const 2017-08-26 08:41:15 -04:00
cx23885-input.c media: rc: rename RC_TYPE_* to RC_PROTO_* and RC_BIT_* to RC_PROTO_BIT_* 2017-08-20 10:02:48 -04:00
cx23885-input.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
cx23885-ioctl.c [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
cx23885-ioctl.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
cx23885-ir.c [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
cx23885-ir.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
cx23885-reg.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
cx23885-vbi.c [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
cx23885-video.c [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
cx23885-video.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
cx23885.h [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
cx23888-ir.c [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
cx23888-ir.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
Kconfig [media] cx23885: add support for ViewCast 260e and 460e 2015-12-18 13:36:43 -02:00
Makefile [media] cx23885: remove btcx-risc dependency 2014-09-08 10:01:00 -03:00
netup-eeprom.c [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
netup-eeprom.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00
netup-init.c [media] cx23885: convert it to use pr_foo() macros 2016-11-18 08:09:36 -02:00
netup-init.h [media] cx23885: remove FSF address as per checkpatch 2014-09-03 08:35:55 -03:00