[PATCH 0/2] Fix use-after-free errors when unregistering the i2c_client for the dvb demod

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi!

There seem to be a general error in a lot of dvb bride drivers about the order of i2c_unregister_device
and the calls to dvb_unregister_frontend and dvb_frontend_detach.

As soon as the i2c_client for a demod driver is unregistered the memory for the frontend is kfreed.
But the calls to dvb_unregister_frontend and dvb_frontend_detach access it later.

I fixed the error in cx23885 and cx231xx driver as I have access to the hardware.

Further drivers that might show the same bug (but I cannot test):
* em28xx
* ddbride
* saa7164

Regards
Matthias




[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux