From: Shuah Khan <shuahkh@osg.samsung.com>
To: linux-media@vger.kernel.org, mchehab@osg.samsung.com,
linux-kernel@vger.kernel.org,
Shuah Khan <shuahkh@osg.samsung.com>
Subject: Re: [PATCH 2/3] drivers/media/media-entity: clear media_gobj.mdev in _destroy()
Date: Thu, 16 Jun 2016 12:55:28 -0600 [thread overview]
Message-ID: <5762F620.3010709@osg.samsung.com> (raw)
In-Reply-To: <20160616184353.GB3727@swift.blarg.de>
On 06/16/2016 12:43 PM, Max Kellermann wrote:
> On 2016/06/16 18:24, Shuah Khan <shuahkh@osg.samsung.com> wrote:
>> On 06/15/2016 02:15 PM, Max Kellermann wrote:
>>> media_gobj_destroy() may be called twice on one instance - once by
>>> media_device_unregister() and again by dvb_media_device_free(). The
>>> function media_remove_intf_links() establishes and documents the
>>> convention that mdev==NULL means that the object is not registered,
>>> but nobody ever NULLs this variable. So this patch really implements
>>> this behavior, and adds another mdev==NULL check to
>>> media_gobj_destroy() to protect against double removal.
>>
>> Are you seeing null pointer dereference on gobj->mdev? In any case,
>> we have to look at if there is a missing mutex hold that creates a
>> race between media_device_unregister() and dvb_media_device_free()
>>
>> I don't this patch will solve the race condition.
>
> I think we misunderstand. This is not about a race condition. And
> the problem cannot be a NULL pointer dereference.
>
> That's because nobody NULLs the pointer!
I see 7 calls to media_gobj_destroy(). In 6 cases, calling routines
fee the pointer that contains the graph_obj.
__media_device_unregister_entity() sets mdev ot null.
entity->graph_obj.mdev = NULL;
That is why I am confused when you say it never set to null.
thanks,
-- Shuah
next prev parent reply other threads:[~2016-06-16 18:55 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-15 20:15 [PATCH 1/3] drivers/media/dvb-core/en50221: use kref to manage struct dvb_ca_private Max Kellermann
2016-06-15 20:15 ` [PATCH 2/3] drivers/media/media-entity: clear media_gobj.mdev in _destroy() Max Kellermann
2016-06-16 16:24 ` Shuah Khan
2016-06-16 18:43 ` Max Kellermann
2016-06-16 18:55 ` Shuah Khan [this message]
2016-06-17 12:53 ` Sakari Ailus
2016-06-17 13:04 ` Max Kellermann
2016-06-15 20:15 ` [PATCH 3/3] drivers/media/media-device: fix double free bug in _unregister() Max Kellermann
2016-06-15 20:32 ` Shuah Khan
2016-06-15 20:37 ` Max Kellermann
2016-06-15 21:50 ` Shuah Khan
2016-06-16 9:29 ` Max Kellermann
2016-06-16 13:40 ` Shuah Khan
2016-06-16 16:06 ` [PATCH 1/3] drivers/media/dvb-core/en50221: use kref to manage struct dvb_ca_private Shuah Khan
2016-06-16 18:37 ` Max Kellermann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5762F620.3010709@osg.samsung.com \
--to=shuahkh@osg.samsung.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@osg.samsung.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).