]> git.baikalelectronics.ru Git - kernel.git/commit
media: dvbsky: Avoid leaking dvb frontend
authorStefan Brüns <stefan.bruens@rwth-aachen.de>
Sun, 20 Jan 2019 01:30:04 +0000 (20:30 -0500)
committerMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Tue, 19 Mar 2019 20:42:24 +0000 (16:42 -0400)
commit63824b46eab5fcd5f4c3413108c871e2291bc2ee
treeb50e3935a7bfa0415a93c895d7e386da11d042ca
parent92b05548bc04839de2c3e480201741c2d7609b8b
media: dvbsky: Avoid leaking dvb frontend

Commit 20ab60885a1d ("media: dvbsky: fix driver unregister logic") fixed
a use-after-free by removing the reference to the frontend after deleting
the backing i2c device.

This has the unfortunate side effect the frontend device is never freed
in the dvb core leaving a dangling device, leading to errors when the
dvb core tries to register the frontend after e.g. a replug as reported
here: https://www.spinics.net/lists/linux-media/msg138181.html

media: dvbsky: issues with DVBSky T680CI

===
[  561.119145] sp2 8-0040: CIMaX SP2 successfully attached
[  561.119161] usb 2-3: DVB: registering adapter 0 frontend 0 (Silicon Labs
Si2168)...
[  561.119174] sysfs: cannot create duplicate filename '/class/dvb/
dvb0.frontend0'
===

The use after free happened as dvb_usbv2_disconnect calls in this order:
- dvb_usb_device::props->exit(...)
- dvb_usbv2_adapter_frontend_exit(...)
  + if (fe) dvb_unregister_frontend(fe)
  + dvb_usb_device::props->frontend_detach(...)

Moving the release of the i2c device from exit() to frontend_detach()
avoids the dangling pointer access and allows the core to unregister
the frontend.

This was originally reported for a DVBSky T680CI, but it also affects
the MyGica T230C. As all supported devices structure the registration/
unregistration identically, apply the change for all device types.

Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
drivers/media/usb/dvb-usb-v2/dvbsky.c