* [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'
@ 2020-02-03 13:21 ` Lee Jones
0 siblings, 0 replies; 12+ messages in thread
From: Lee Jones @ 2020-02-03 13:21 UTC (permalink / raw)
To: stable; +Cc: linux-kernel, linux-arm-kernel
A pointer to 'struct si470x_device' is currently used after free:
drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
preceded by free on line 460
Shift the call to free() down past its final use.
NB: Not sending to Mainline, since the problem does not exist there.
Cc: <stable@vger.kernel.org> # v3.18+
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
---
drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index ae7540b765e1d..aa12fd2663895 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -483,10 +483,10 @@ static int si470x_i2c_remove(struct i2c_client *client)
free_irq(client->irq, radio);
video_unregister_device(&radio->videodev);
- kfree(radio);
v4l2_ctrl_handler_free(&radio->hdl);
v4l2_device_unregister(&radio->v4l2_dev);
+ kfree(radio);
return 0;
}
--
2.24.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 12+ messages in thread* Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'
2020-02-03 13:21 ` Lee Jones
@ 2020-02-03 14:32 ` Greg KH
-1 siblings, 0 replies; 12+ messages in thread
From: Greg KH @ 2020-02-03 14:32 UTC (permalink / raw)
To: Lee Jones; +Cc: stable, linux-arm-kernel, linux-kernel
On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> A pointer to 'struct si470x_device' is currently used after free:
>
> drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
> preceded by free on line 460
>
> Shift the call to free() down past its final use.
>
> NB: Not sending to Mainline, since the problem does not exist there.
It doesn't exist there because of a bad merge? What commit caused the
problem?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'
@ 2020-02-03 14:32 ` Greg KH
0 siblings, 0 replies; 12+ messages in thread
From: Greg KH @ 2020-02-03 14:32 UTC (permalink / raw)
To: Lee Jones; +Cc: linux-arm-kernel, stable, linux-kernel
On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> A pointer to 'struct si470x_device' is currently used after free:
>
> drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
> preceded by free on line 460
>
> Shift the call to free() down past its final use.
>
> NB: Not sending to Mainline, since the problem does not exist there.
It doesn't exist there because of a bad merge? What commit caused the
problem?
thanks,
greg k-h
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'
2020-02-03 14:32 ` Greg KH
@ 2020-02-03 14:58 ` Greg KH
-1 siblings, 0 replies; 12+ messages in thread
From: Greg KH @ 2020-02-03 14:58 UTC (permalink / raw)
To: Lee Jones; +Cc: stable, linux-arm-kernel, linux-kernel
On Mon, Feb 03, 2020 at 02:32:45PM +0000, Greg KH wrote:
> On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> > A pointer to 'struct si470x_device' is currently used after free:
> >
> > drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
> > preceded by free on line 460
> >
> > Shift the call to free() down past its final use.
> >
> > NB: Not sending to Mainline, since the problem does not exist there.
>
> It doesn't exist there because of a bad merge? What commit caused the
> problem?
Ah, found it, it was 2df200ab234a ("media: si470x-i2c: add missed
operations in remove")
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'
@ 2020-02-03 14:58 ` Greg KH
0 siblings, 0 replies; 12+ messages in thread
From: Greg KH @ 2020-02-03 14:58 UTC (permalink / raw)
To: Lee Jones; +Cc: linux-arm-kernel, stable, linux-kernel
On Mon, Feb 03, 2020 at 02:32:45PM +0000, Greg KH wrote:
> On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> > A pointer to 'struct si470x_device' is currently used after free:
> >
> > drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
> > preceded by free on line 460
> >
> > Shift the call to free() down past its final use.
> >
> > NB: Not sending to Mainline, since the problem does not exist there.
>
> It doesn't exist there because of a bad merge? What commit caused the
> problem?
Ah, found it, it was 2df200ab234a ("media: si470x-i2c: add missed
operations in remove")
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'
2020-02-03 14:58 ` Greg KH
@ 2020-02-03 15:12 ` Lee Jones
-1 siblings, 0 replies; 12+ messages in thread
From: Lee Jones @ 2020-02-03 15:12 UTC (permalink / raw)
To: Greg KH; +Cc: stable, linux-arm-kernel, linux-kernel
On Mon, 03 Feb 2020, Greg KH wrote:
> On Mon, Feb 03, 2020 at 02:32:45PM +0000, Greg KH wrote:
> > On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> > > A pointer to 'struct si470x_device' is currently used after free:
> > >
> > > drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
> > > preceded by free on line 460
> > >
> > > Shift the call to free() down past its final use.
> > >
> > > NB: Not sending to Mainline, since the problem does not exist there.
> >
> > It doesn't exist there because of a bad merge? What commit caused the
> > problem?
>
> Ah, found it, it was 2df200ab234a ("media: si470x-i2c: add missed
> operations in remove")
I was about to follow up with a v2:
"NB: Cauased during the backporting of upstream commit 2df200ab234a
("media: si470x-i2c: add missed operations in remove"). This issue does
not exist in Mainline since the kfree() was removed in v5.0 as part of
commit f86c51b66bf6 ("media: si470x-i2c: Use managed resource helpers")."
--
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'
@ 2020-02-03 15:12 ` Lee Jones
0 siblings, 0 replies; 12+ messages in thread
From: Lee Jones @ 2020-02-03 15:12 UTC (permalink / raw)
To: Greg KH; +Cc: linux-arm-kernel, stable, linux-kernel
On Mon, 03 Feb 2020, Greg KH wrote:
> On Mon, Feb 03, 2020 at 02:32:45PM +0000, Greg KH wrote:
> > On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> > > A pointer to 'struct si470x_device' is currently used after free:
> > >
> > > drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
> > > preceded by free on line 460
> > >
> > > Shift the call to free() down past its final use.
> > >
> > > NB: Not sending to Mainline, since the problem does not exist there.
> >
> > It doesn't exist there because of a bad merge? What commit caused the
> > problem?
>
> Ah, found it, it was 2df200ab234a ("media: si470x-i2c: add missed
> operations in remove")
I was about to follow up with a v2:
"NB: Cauased during the backporting of upstream commit 2df200ab234a
("media: si470x-i2c: add missed operations in remove"). This issue does
not exist in Mainline since the kfree() was removed in v5.0 as part of
commit f86c51b66bf6 ("media: si470x-i2c: Use managed resource helpers")."
--
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread
* Patch "media: si470x-i2c: Move free() past last use of 'radio'" has been added to the 4.4-stable tree
2020-02-03 13:21 ` Lee Jones
(?)
(?)
@ 2020-02-03 15:01 ` gregkh
-1 siblings, 0 replies; 12+ messages in thread
From: gregkh @ 2020-02-03 15:01 UTC (permalink / raw)
To: gregkh, julia.lawall, lee.jones, linux-arm-kernel, lkp; +Cc: stable-commits
This is a note to let you know that I've just added the patch titled
media: si470x-i2c: Move free() past last use of 'radio'
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
media-si470x-i2c-move-free-past-last-use-of-radio.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From lee.jones@linaro.org Mon Feb 3 14:58:36 2020
From: Lee Jones <lee.jones@linaro.org>
Date: Mon, 3 Feb 2020 13:21:30 +0000
Subject: media: si470x-i2c: Move free() past last use of 'radio'
To: stable@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org
Message-ID: <20200203132130.12748-1-lee.jones@linaro.org>
From: Lee Jones <lee.jones@linaro.org>
A pointer to 'struct si470x_device' is currently used after free:
drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
preceded by free on line 460
Shift the call to free() down past its final use.
NB: Not sending to Mainline, since the problem does not exist there, it was
caused by the backport of 2df200ab234a ("media: si470x-i2c: add missed
operations in remove") to the stable trees.
Cc: <stable@vger.kernel.org> # v3.18+
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -458,10 +458,10 @@ static int si470x_i2c_remove(struct i2c_
free_irq(client->irq, radio);
video_unregister_device(&radio->videodev);
- kfree(radio);
v4l2_ctrl_handler_free(&radio->hdl);
v4l2_device_unregister(&radio->v4l2_dev);
+ kfree(radio);
return 0;
}
Patches currently in stable-queue which might be from lee.jones@linaro.org are
queue-4.4/media-si470x-i2c-move-free-past-last-use-of-radio.patch
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread* Patch "media: si470x-i2c: Move free() past last use of 'radio'" has been added to the 4.9-stable tree
2020-02-03 13:21 ` Lee Jones
` (2 preceding siblings ...)
(?)
@ 2020-02-03 15:01 ` gregkh
-1 siblings, 0 replies; 12+ messages in thread
From: gregkh @ 2020-02-03 15:01 UTC (permalink / raw)
To: gregkh, julia.lawall, lee.jones, linux-arm-kernel, lkp; +Cc: stable-commits
This is a note to let you know that I've just added the patch titled
media: si470x-i2c: Move free() past last use of 'radio'
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
media-si470x-i2c-move-free-past-last-use-of-radio.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From lee.jones@linaro.org Mon Feb 3 14:58:36 2020
From: Lee Jones <lee.jones@linaro.org>
Date: Mon, 3 Feb 2020 13:21:30 +0000
Subject: media: si470x-i2c: Move free() past last use of 'radio'
To: stable@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org
Message-ID: <20200203132130.12748-1-lee.jones@linaro.org>
From: Lee Jones <lee.jones@linaro.org>
A pointer to 'struct si470x_device' is currently used after free:
drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
preceded by free on line 460
Shift the call to free() down past its final use.
NB: Not sending to Mainline, since the problem does not exist there, it was
caused by the backport of 2df200ab234a ("media: si470x-i2c: add missed
operations in remove") to the stable trees.
Cc: <stable@vger.kernel.org> # v3.18+
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -458,10 +458,10 @@ static int si470x_i2c_remove(struct i2c_
free_irq(client->irq, radio);
video_unregister_device(&radio->videodev);
- kfree(radio);
v4l2_ctrl_handler_free(&radio->hdl);
v4l2_device_unregister(&radio->v4l2_dev);
+ kfree(radio);
return 0;
}
Patches currently in stable-queue which might be from lee.jones@linaro.org are
queue-4.9/media-si470x-i2c-move-free-past-last-use-of-radio.patch
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread* Patch "media: si470x-i2c: Move free() past last use of 'radio'" has been added to the 4.14-stable tree
2020-02-03 13:21 ` Lee Jones
` (3 preceding siblings ...)
(?)
@ 2020-02-03 15:01 ` gregkh
-1 siblings, 0 replies; 12+ messages in thread
From: gregkh @ 2020-02-03 15:01 UTC (permalink / raw)
To: gregkh, julia.lawall, lee.jones, linux-arm-kernel, lkp; +Cc: stable-commits
This is a note to let you know that I've just added the patch titled
media: si470x-i2c: Move free() past last use of 'radio'
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
media-si470x-i2c-move-free-past-last-use-of-radio.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From lee.jones@linaro.org Mon Feb 3 14:58:36 2020
From: Lee Jones <lee.jones@linaro.org>
Date: Mon, 3 Feb 2020 13:21:30 +0000
Subject: media: si470x-i2c: Move free() past last use of 'radio'
To: stable@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org
Message-ID: <20200203132130.12748-1-lee.jones@linaro.org>
From: Lee Jones <lee.jones@linaro.org>
A pointer to 'struct si470x_device' is currently used after free:
drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
preceded by free on line 460
Shift the call to free() down past its final use.
NB: Not sending to Mainline, since the problem does not exist there, it was
caused by the backport of 2df200ab234a ("media: si470x-i2c: add missed
operations in remove") to the stable trees.
Cc: <stable@vger.kernel.org> # v3.18+
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -453,10 +453,10 @@ static int si470x_i2c_remove(struct i2c_
free_irq(client->irq, radio);
video_unregister_device(&radio->videodev);
- kfree(radio);
v4l2_ctrl_handler_free(&radio->hdl);
v4l2_device_unregister(&radio->v4l2_dev);
+ kfree(radio);
return 0;
}
Patches currently in stable-queue which might be from lee.jones@linaro.org are
queue-4.14/media-si470x-i2c-move-free-past-last-use-of-radio.patch
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread* Patch "media: si470x-i2c: Move free() past last use of 'radio'" has been added to the 4.19-stable tree
2020-02-03 13:21 ` Lee Jones
` (4 preceding siblings ...)
(?)
@ 2020-02-03 15:02 ` gregkh
-1 siblings, 0 replies; 12+ messages in thread
From: gregkh @ 2020-02-03 15:02 UTC (permalink / raw)
To: gregkh, julia.lawall, lee.jones, linux-arm-kernel, lkp; +Cc: stable-commits
This is a note to let you know that I've just added the patch titled
media: si470x-i2c: Move free() past last use of 'radio'
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
media-si470x-i2c-move-free-past-last-use-of-radio.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From lee.jones@linaro.org Mon Feb 3 14:58:36 2020
From: Lee Jones <lee.jones@linaro.org>
Date: Mon, 3 Feb 2020 13:21:30 +0000
Subject: media: si470x-i2c: Move free() past last use of 'radio'
To: stable@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org
Message-ID: <20200203132130.12748-1-lee.jones@linaro.org>
From: Lee Jones <lee.jones@linaro.org>
A pointer to 'struct si470x_device' is currently used after free:
drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
preceded by free on line 460
Shift the call to free() down past its final use.
NB: Not sending to Mainline, since the problem does not exist there, it was
caused by the backport of 2df200ab234a ("media: si470x-i2c: add missed
operations in remove") to the stable trees.
Cc: <stable@vger.kernel.org> # v3.18+
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -483,10 +483,10 @@ static int si470x_i2c_remove(struct i2c_
free_irq(client->irq, radio);
video_unregister_device(&radio->videodev);
- kfree(radio);
v4l2_ctrl_handler_free(&radio->hdl);
v4l2_device_unregister(&radio->v4l2_dev);
+ kfree(radio);
return 0;
}
Patches currently in stable-queue which might be from lee.jones@linaro.org are
queue-4.19/media-si470x-i2c-move-free-past-last-use-of-radio.patch
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 12+ messages in thread