From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
To: Max Kellermann <max@duempel.org>
Cc: linux-kernel@vger.kernel.org, linux-media@vger.kernel.org
Subject: Re: [PATCH 2/6] drivers/media/dvb-core/en50221: postpone release until file is closed
Date: Thu, 9 Jun 2016 06:38:38 -0300 [thread overview]
Message-ID: <20160609063838.0ac83d84@recife.lan> (raw)
In-Reply-To: <145856702263.21117.11870746253652920203.stgit@woodpecker.blarg.de>
Em Mon, 21 Mar 2016 14:30:22 +0100
Max Kellermann <max@duempel.org> escreveu:
> Fixes use-after-free bug which occurs when I disconnect my DVB-S
> received while VDR is running.
I guess that the best way to fix it is to use a kref() that would be also
incremented at open() and decremented at release().
This works better than adding other non-standard ways to manage data livetime
cycle.
Regards,
Mauro
>
> Signed-off-by: Max Kellermann <max@duempel.org>
> ---
> drivers/media/dvb-core/dvb_ca_en50221.c | 23 ++++++++++++++++++++++-
> 1 file changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
> index e33364c..dfc686a 100644
> --- a/drivers/media/dvb-core/dvb_ca_en50221.c
> +++ b/drivers/media/dvb-core/dvb_ca_en50221.c
> @@ -148,6 +148,9 @@ struct dvb_ca_private {
> /* Flag indicating if the CA device is open */
> unsigned int open:1;
>
> + /* Flag indicating if the CA device is released */
> + unsigned int released:1;
> +
> /* Flag indicating the thread should wake up now */
> unsigned int wakeup:1;
>
> @@ -1392,6 +1395,11 @@ static int dvb_ca_en50221_io_read_condition(struct dvb_ca_private *ca,
> int found = 0;
> u8 hdr[2];
>
> + if (ca->released) {
> + *result = -ENODEV;
> + return 1;
> + }
> +
> slot = ca->next_read_slot;
> while ((slot_count < ca->slot_count) && (!found)) {
> if (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_RUNNING)
> @@ -1595,6 +1603,9 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
>
> err = dvb_generic_release(inode, file);
>
> + if (ca->released)
> + dvb_ca_private_free(ca);
> +
> module_put(ca->pub->owner);
>
> return err;
> @@ -1701,6 +1712,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter,
> }
> init_waitqueue_head(&ca->wait_queue);
> ca->open = 0;
> + ca->released = 0;
> ca->wakeup = 0;
> ca->next_read_slot = 0;
> pubca->private = ca;
> @@ -1765,12 +1777,21 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca)
>
> dprintk("%s\n", __func__);
>
> + BUG_ON(ca->released);
> +
> /* shutdown the thread if there was one */
> kthread_stop(ca->thread);
>
> for (i = 0; i < ca->slot_count; i++) {
> dvb_ca_en50221_slot_shutdown(ca, i);
> }
> - dvb_ca_private_free(ca);
> +
> + if (ca->open) {
> + ca->released = 1;
> + mb();
> + wake_up_interruptible(&ca->wait_queue);
> + } else
> + dvb_ca_private_free(ca);
> +
> pubca->private = NULL;
> }
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-media" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Thanks,
Mauro
next prev parent reply other threads:[~2016-06-09 9:38 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-21 13:30 [PATCH 1/6] drivers/media/dvb-core/en50221: move code to dvb_ca_private_free() Max Kellermann
2016-03-21 13:30 ` [PATCH 2/6] drivers/media/dvb-core/en50221: postpone release until file is closed Max Kellermann
2016-06-09 9:38 ` Mauro Carvalho Chehab [this message]
2016-03-21 13:30 ` [PATCH 3/6] drivers/media/media-devnode: clear private_data before put_device() Max Kellermann
2016-03-21 13:30 ` [PATCH 4/6] drivers/media/media-device: move debug log before _devnode_unregister() Max Kellermann
2016-03-21 13:30 ` [PATCH 5/6] drivers/media/media-device: add "release" callback Max Kellermann
2016-06-09 11:56 ` Mauro Carvalho Chehab
2016-03-21 13:30 ` [PATCH 6/6] drivers/media/dvb-usb-dvb: postpone kfree(mdev) Max Kellermann
2016-03-21 13:45 ` kbuild test robot
2016-03-21 13:56 ` kbuild test robot
2016-03-21 13:55 ` [PATCH 1/6] drivers/media/dvb-core/en50221: move code to dvb_ca_private_free() kbuild test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160609063838.0ac83d84@recife.lan \
--to=mchehab@osg.samsung.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=max@duempel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).