* [PATCH] pvrusb2: Fix oops on tear-down when radio support is not present
@ 2019-11-06 11:11 Mike Isely
0 siblings, 0 replies; 4+ messages in thread
From: Mike Isely @ 2019-11-06 11:11 UTC (permalink / raw)
To: Mauro Carvalho Chehab, Hans Verkuil, linux-media,
Linux Kernel Mailing List
Cc: Mike Isely at pobox
In some device configurations there's no radio or radio support in the
driver. That's OK, as the driver sets itself up accordingly. However
on tear-down in these caes it's still trying to tear down radio
related context when there isn't anything there, leading to
dereferences through a null pointer and chaos follows.
How this bug survived unfixed for 11 years in the pvrusb2 driver is a
mystery to me.
Signed-off-by: Mike Isely <isely@pobox.com>
---
drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
index aa4fbc3e88cc..339119f6cc23 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
@@ -909,8 +909,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp)
pvr2_v4l2_dev_disassociate_parent(vp->dev_video);
pvr2_v4l2_dev_disassociate_parent(vp->dev_radio);
if (!list_empty(&vp->dev_video->devbase.fh_list) ||
- !list_empty(&vp->dev_radio->devbase.fh_list))
+ ((vp->dev_radio != NULL) &&
+ !list_empty(&vp->dev_radio->devbase.fh_list))) {
+ pvr2_trace(PVR2_TRACE_STRUCT,
+ "pvr2_v4l2 internal_check exit-empty id=%p", vp);
return;
+ }
pvr2_v4l2_destroy_no_lock(vp);
}
@@ -946,7 +950,8 @@ static int pvr2_v4l2_release(struct file *file)
kfree(fhp);
if (vp->channel.mc_head->disconnect_flag &&
list_empty(&vp->dev_video->devbase.fh_list) &&
- list_empty(&vp->dev_radio->devbase.fh_list)) {
+ ((vp->dev_radio == NULL) ||
+ list_empty(&vp->dev_radio->devbase.fh_list))) {
pvr2_v4l2_destroy_no_lock(vp);
}
return 0;
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] pvrusb2: Fix oops on tear-down when radio support is not present
2019-11-06 7:29 ` Hans Verkuil
@ 2019-11-06 11:12 ` Mike Isely
0 siblings, 0 replies; 4+ messages in thread
From: Mike Isely @ 2019-11-06 11:12 UTC (permalink / raw)
To: Hans Verkuil
Cc: Mauro Carvalho Chehab, linux-media, Linux Kernel Mailing List,
Mike Isely
Thanks for spotting that. I think I had eliminated the from header
because I thought I was seeing a duplicate from header and didn't want
to cause confusion. That'll teach me.
It's been reposted.
-Mike
On Wed, 6 Nov 2019, Hans Verkuil wrote:
> Hi Mike,
>
> For some reason your mailer didn't include a "From:" line, only a "Reply-To:"
> line. This means that the patch authorship is not detected by patchwork and
> git. Can you repost with a valid From: line in the email header?
>
> Thanks!
>
> Hans
>
[...]
--
Mike Isely
isely @ isely (dot) net
PGP: 03 54 43 4D 75 E5 CC 92 71 16 01 E2 B5 F5 C1 E8
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] pvrusb2: Fix oops on tear-down when radio support is not present
2019-11-06 2:36
@ 2019-11-06 7:29 ` Hans Verkuil
2019-11-06 11:12 ` Mike Isely
0 siblings, 1 reply; 4+ messages in thread
From: Hans Verkuil @ 2019-11-06 7:29 UTC (permalink / raw)
To: Mike Isely at pobox, Mauro Carvalho Chehab, linux-media,
Linux Kernel Mailing List
Hi Mike,
For some reason your mailer didn't include a "From:" line, only a "Reply-To:"
line. This means that the patch authorship is not detected by patchwork and
git. Can you repost with a valid From: line in the email header?
Thanks!
Hans
On 11/6/19 3:36 AM, wrote:
> In some device configurations there's no radio or radio support in the
> driver. That's OK, as the driver sets itself up accordingly. However
> on tear-down in these caes it's still trying to tear down radio
> related context when there isn't anything there, leading to
> dereferences through a null pointer and chaos follows.
>
> How this bug survived unfixed for 11 years in the pvrusb2 driver is a
> mystery to me.
>
> Signed-off-by: Mike Isely <isely@pobox.com>
> ---
> drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
> index aa4fbc3e88cc..339119f6cc23 100644
> --- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
> +++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
> @@ -909,8 +909,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp)
> pvr2_v4l2_dev_disassociate_parent(vp->dev_video);
> pvr2_v4l2_dev_disassociate_parent(vp->dev_radio);
> if (!list_empty(&vp->dev_video->devbase.fh_list) ||
> - !list_empty(&vp->dev_radio->devbase.fh_list))
> + ((vp->dev_radio != NULL) &&
> + !list_empty(&vp->dev_radio->devbase.fh_list))) {
> + pvr2_trace(PVR2_TRACE_STRUCT,
> + "pvr2_v4l2 internal_check exit-empty id=%p", vp);
> return;
> + }
> pvr2_v4l2_destroy_no_lock(vp);
> }
>
> @@ -946,7 +950,8 @@ static int pvr2_v4l2_release(struct file *file)
> kfree(fhp);
> if (vp->channel.mc_head->disconnect_flag &&
> list_empty(&vp->dev_video->devbase.fh_list) &&
> - list_empty(&vp->dev_radio->devbase.fh_list)) {
> + ((vp->dev_radio == NULL) ||
> + list_empty(&vp->dev_radio->devbase.fh_list))) {
> pvr2_v4l2_destroy_no_lock(vp);
> }
> return 0;
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] pvrusb2: Fix oops on tear-down when radio support is not present
@ 2019-11-06 2:36
2019-11-06 7:29 ` Hans Verkuil
0 siblings, 1 reply; 4+ messages in thread
From: @ 2019-11-06 2:36 UTC (permalink / raw)
To: Mauro Carvalho Chehab, Hans Verkuil, linux-media,
Linux Kernel Mailing List
Cc: Mike Isely at pobox
In some device configurations there's no radio or radio support in the
driver. That's OK, as the driver sets itself up accordingly. However
on tear-down in these caes it's still trying to tear down radio
related context when there isn't anything there, leading to
dereferences through a null pointer and chaos follows.
How this bug survived unfixed for 11 years in the pvrusb2 driver is a
mystery to me.
Signed-off-by: Mike Isely <isely@pobox.com>
---
drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
index aa4fbc3e88cc..339119f6cc23 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
@@ -909,8 +909,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp)
pvr2_v4l2_dev_disassociate_parent(vp->dev_video);
pvr2_v4l2_dev_disassociate_parent(vp->dev_radio);
if (!list_empty(&vp->dev_video->devbase.fh_list) ||
- !list_empty(&vp->dev_radio->devbase.fh_list))
+ ((vp->dev_radio != NULL) &&
+ !list_empty(&vp->dev_radio->devbase.fh_list))) {
+ pvr2_trace(PVR2_TRACE_STRUCT,
+ "pvr2_v4l2 internal_check exit-empty id=%p", vp);
return;
+ }
pvr2_v4l2_destroy_no_lock(vp);
}
@@ -946,7 +950,8 @@ static int pvr2_v4l2_release(struct file *file)
kfree(fhp);
if (vp->channel.mc_head->disconnect_flag &&
list_empty(&vp->dev_video->devbase.fh_list) &&
- list_empty(&vp->dev_radio->devbase.fh_list)) {
+ ((vp->dev_radio == NULL) ||
+ list_empty(&vp->dev_radio->devbase.fh_list))) {
pvr2_v4l2_destroy_no_lock(vp);
}
return 0;
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-11-06 11:18 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-06 11:11 [PATCH] pvrusb2: Fix oops on tear-down when radio support is not present Mike Isely
-- strict thread matches above, loose matches on Subject: below --
2019-11-06 2:36
2019-11-06 7:29 ` Hans Verkuil
2019-11-06 11:12 ` Mike Isely
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.