]> git.baikalelectronics.ru Git - kernel.git/commit
[media] media-entity: cache media_device on object removal
authorMauro Carvalho Chehab <mchehab@osg.samsung.com>
Tue, 15 Dec 2015 10:01:13 +0000 (08:01 -0200)
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>
Mon, 11 Jan 2016 14:19:14 +0000 (12:19 -0200)
commit2246c259bc1578b56e3f1bcf6c2e382f22d09a14
treebd0e2f7ef813fe7c73acef2b27d795ca0d9fa945
parent02cea8c66a33745d56c4389becb44e7ec5f1b22c
[media] media-entity: cache media_device on object removal

As pointed by Dan, the commit f8fd4c61b5ae ("[media] media-entity:
protect object creation/removal using spin lock")' leads to the
following static checker warning:

drivers/media/media-entity.c:781 media_remove_intf_link()
error: dereferencing freed memory 'link'

drivers/media/media-entity.c
   777  void media_remove_intf_link(struct media_link *link)
   778  {
   779          spin_lock(&link->graph_obj.mdev->lock);
   780          __media_remove_intf_link(link);
   781          spin_unlock(&link->graph_obj.mdev->lock);

In practice, I didn't see any troubles even with KASAN enabled. I guess
gcc optimizer internally cached the mdev reference, instead of getting
it twice. Yet, it is a very bad idea to rely on such optimization. So,
let's fix the code.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/media-entity.c