]> git.baikalelectronics.ru Git - kernel.git/commit
media: dvbsky: Avoid leaking dvb frontend
authorStefan Brüns <stefan.bruens@rwth-aachen.de>
Sun, 20 Jan 2019 01:30:04 +0000 (20:30 -0500)
committerMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Tue, 19 Mar 2019 20:42:24 +0000 (16:42 -0400)
commit2c0e2ecafc59ce26537dabca3c9eeef3cc318861
treeb50e3935a7bfa0415a93c895d7e386da11d042ca
parent936035b7c1bedccd028ee14c970f3159de590e85
media: dvbsky: Avoid leaking dvb frontend

Commit 98f1701e5a5a ("media: dvbsky: fix driver unregister logic") fixed
a use-after-free by removing the reference to the frontend after deleting
the backing i2c device.

This has the unfortunate side effect the frontend device is never freed
in the dvb core leaving a dangling device, leading to errors when the
dvb core tries to register the frontend after e.g. a replug as reported
here: https://www.spinics.net/lists/linux-media/msg138181.html

media: dvbsky: issues with DVBSky T680CI

===
[  561.119145] sp2 8-0040: CIMaX SP2 successfully attached
[  561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs
Si2168)...
[  561.119174] sysfs: cannot create duplicate filename '/class/dvb/
dvb0.frontend0'
===

The use after free happened as dvb_usbv2_disconnect calls in this order:
- dvb_usb_device::props->exit(...)
- dvb_usbv2_adapter_frontend_exit(...)
  + if (fe) dvb_unregister_frontend(fe)
  + dvb_usb_device::props->frontend_detach(...)

Moving the release of the i2c device from exit() to frontend_detach()
avoids the dangling pointer access and allows the core to unregister
the frontend.

This was originally reported for a DVBSky T680CI, but it also affects
the MyGica T230C. As all supported devices structure the registration/
unregistration identically, apply the change for all device types.

Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
drivers/media/usb/dvb-usb-v2/dvbsky.c