From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Brad Love <brad@nextdimension.cc>,
Hans Verkuil <hans.verkuil@cisco.com>,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 09/37] media: au0828: cannot kfree dev before usb disconnect
Date: Fri, 29 Mar 2019 21:29:52 -0400 [thread overview]
Message-ID: <20190330013020.379-9-sashal@kernel.org> (raw)
In-Reply-To: <20190330013020.379-1-sashal@kernel.org>
From: Brad Love <brad@nextdimension.cc>
[ Upstream commit 4add7104919f9e94e0db03e234caeadbfcc02ea9 ]
If au0828_analog_register fails, the dev is kfree'd and then flow
jumps to done, which can call au0828_usb_disconnect. Since all USB
error codes are negative, au0828_usb_disconnect will be called. The
problem is au0828_usb_disconnect uses dev, if dev is NULL then there
is immediate oops encountered.
[ 7.454307] au0828: au0828_usb_probe() au0282_dev_register failed to register on V4L2
[ 7.454323] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
[ 7.454421] PGD 0 P4D 0
[ 7.454457] Oops: 0002 [#1] SMP PTI
[ 7.454500] CPU: 1 PID: 262 Comm: systemd-udevd Tainted: P O 4.18.3 #1
[ 7.454584] Hardware name: Google Panther/Panther, BIOS MattDevo 04/27/2015
[ 7.454670] RIP: 0010:_raw_spin_lock_irqsave+0x2c/0x50
[ 7.454725] Code: 44 00 00 55 48 89 e5 41 54 53 48 89 fb 9c 58 0f 1f 44 00 00 49 89 c4 fa 66 0f 1f 44 00 00 e8 db 23 1b ff 31 c0 ba 01 00 00 00 <f0> 0f b1 13 85 c0 75 08 4c 89 e0 5b 41 5c 5d c3 89 c6 48 89 df e8
[ 7.455004] RSP: 0018:ffff9130f53ef988 EFLAGS: 00010046
[ 7.455063] RAX: 0000000000000000 RBX: 0000000000000050 RCX: 0000000000000000
[ 7.455139] RDX: 0000000000000001 RSI: 0000000000000003 RDI: 0000000000000050
[ 7.455216] RBP: ffff9130f53ef998 R08: 0000000000000018 R09: 0000000000000090
[ 7.455292] R10: ffffed4cc53cb000 R11: ffffed4cc53cb108 R12: 0000000000000082
[ 7.455369] R13: ffff9130cf2c6188 R14: 0000000000000000 R15: 0000000000000018
[ 7.455447] FS: 00007f2ff8514cc0(0000) GS:ffff9130fcb00000(0000) knlGS:0000000000000000
[ 7.455535] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7.455597] CR2: 0000000000000050 CR3: 00000001753f0002 CR4: 00000000000606a0
[ 7.455675] Call Trace:
[ 7.455713] __wake_up_common_lock+0x65/0xc0
[ 7.455764] __wake_up+0x13/0x20
[ 7.455808] ir_lirc_unregister+0x57/0xe0 [rc_core]
[ 7.455865] rc_unregister_device+0xa0/0xc0 [rc_core]
[ 7.455935] au0828_rc_unregister+0x25/0x40 [au0828]
[ 7.455999] au0828_usb_disconnect+0x33/0x80 [au0828]
[ 7.456064] au0828_usb_probe.cold.16+0x8d/0x2aa [au0828]
[ 7.456130] usb_probe_interface+0xf1/0x300
[ 7.456184] driver_probe_device+0x2e3/0x460
[ 7.456235] __driver_attach+0xe4/0x110
[ 7.456282] ? driver_probe_device+0x460/0x460
[ 7.456335] bus_for_each_dev+0x74/0xb0
[ 7.456385] ? kmem_cache_alloc_trace+0x15d/0x1d0
[ 7.456441] driver_attach+0x1e/0x20
[ 7.456485] bus_add_driver+0x159/0x230
[ 7.456532] driver_register+0x70/0xc0
[ 7.456578] usb_register_driver+0x7f/0x140
[ 7.456626] ? 0xffffffffc0474000
[ 7.456674] au0828_init+0xbc/0x1000 [au0828]
[ 7.456725] do_one_initcall+0x4a/0x1c9
[ 7.456771] ? _cond_resched+0x19/0x30
[ 7.456817] ? kmem_cache_alloc_trace+0x15d/0x1d0
[ 7.456873] do_init_module+0x60/0x210
[ 7.456918] load_module+0x221b/0x2710
[ 7.456966] ? vfs_read+0xf5/0x120
[ 7.457010] __do_sys_finit_module+0xbd/0x120
[ 7.457061] ? __do_sys_finit_module+0xbd/0x120
[ 7.457115] __x64_sys_finit_module+0x1a/0x20
[ 7.457166] do_syscall_64+0x5b/0x110
[ 7.457210] entry_SYSCALL_64_after_hwframe+0x49/0xbe
Signed-off-by: Brad Love <brad@nextdimension.cc>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/au0828/au0828-core.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
index cd363a2100d4..257ae0d8cfe2 100644
--- a/drivers/media/usb/au0828/au0828-core.c
+++ b/drivers/media/usb/au0828/au0828-core.c
@@ -629,7 +629,6 @@ static int au0828_usb_probe(struct usb_interface *interface,
pr_err("%s() au0282_dev_register failed to register on V4L2\n",
__func__);
mutex_unlock(&dev->lock);
- kfree(dev);
goto done;
}
--
2.19.1
next prev parent reply other threads:[~2019-03-30 1:30 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-30 1:29 [PATCH AUTOSEL 4.14 01/37] gpio: pxa: handle corner case of unprobed device Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 02/37] rsi: improve kernel thread handling to fix kernel panic Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 03/37] 9p: do not trust pdu content for stat item size Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 04/37] 9p locks: add mount option for lock retry interval Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 05/37] f2fs: fix to do sanity check with current segment number Sasha Levin
2019-03-30 1:29 ` Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 06/37] netfilter: xt_cgroup: shrink size of v2 path Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 07/37] serial: uartps: console_setup() can't be placed to init section Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 08/37] powerpc/pseries: Remove prrn_work workqueue Sasha Levin
2019-03-30 1:29 ` Sasha Levin
2019-03-30 1:29 ` Sasha Levin [this message]
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 10/37] HID: i2c-hid: override HID descriptors for certain devices Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 11/37] ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 12/37] usbip: fix vhci_hcd controller counting Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 13/37] ACPI / SBS: Fix GPE storm on recent MacBookPro's Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 14/37] KVM: nVMX: restore host state in nested_vmx_vmexit for VMFail Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 15/37] compiler.h: update definition of unreachable() Sasha Levin
2019-03-30 1:29 ` [PATCH AUTOSEL 4.14 16/37] cifs: fallback to older infolevels on findfirst queryinfo retry Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 17/37] kernel: hung_task.c: disable on suspend Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 18/37] nvme-pci: fix conflicting p2p resource adds Sasha Levin
2019-03-30 1:30 ` Sasha Levin
2019-04-01 17:37 ` Heitke, Kenneth
2019-04-01 17:37 ` Heitke, Kenneth
2019-04-03 12:57 ` Sasha Levin
2019-04-03 12:57 ` Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 19/37] blk-mq: protect debugfs_create_files() from failures Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 20/37] crypto: sha256/arm - fix crash bug in Thumb2 build Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 21/37] crypto: sha512/arm " Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 22/37] iommu/dmar: Fix buffer overflow during PCI bus notification Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 23/37] kvm: properly check debugfs dentry before using it Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 24/37] soc/tegra: pmc: Drop locking from tegra_powergate_is_powered() Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 25/37] ext4: prohibit fstrim in norecovery mode Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 26/37] lkdtm: Print real addresses Sasha Levin
2019-03-30 1:30 ` [PATCH AUTOSEL 4.14 27/37] lkdtm: Add tests for NULL pointer dereference Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190330013020.379-9-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=brad@nextdimension.cc \
--cc=hans.verkuil@cisco.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.