Re: [PATCH 1/2] cx23885: Fix use-after-free when unregistering the i2c_client for the dvb demod

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Am 02.08.2017 um 18:45 schrieb Matthias Schwarzott:
> diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
> index 979b66627f60..e795ddeb7fe2 100644
> --- a/drivers/media/pci/cx23885/cx23885-dvb.c
> +++ b/drivers/media/pci/cx23885/cx23885-dvb.c
> @@ -2637,6 +2637,11 @@ int cx23885_dvb_unregister(struct cx23885_tsport *port)
>  	struct vb2_dvb_frontend *fe0;
>  	struct i2c_client *client;
>  
> +	fe0 = vb2_dvb_get_frontend(&port->frontends, 1);
> +
> +	if (fe0 && fe0->dvb.frontend)
> +		vb2_dvb_unregister_bus(&port->frontends);
> +
>  	/* remove I2C client for CI */
>  	client = port->i2c_client_ci;
>  	if (client) {
> @@ -2665,11 +2670,6 @@ int cx23885_dvb_unregister(struct cx23885_tsport *port)
>  		i2c_unregister_device(client);
>  	}
>  
> -	fe0 = vb2_dvb_get_frontend(&port->frontends, 1);
> -
> -	if (fe0 && fe0->dvb.frontend)
> -		vb2_dvb_unregister_bus(&port->frontends);
> -

The following code is after i2c_unregister_device.
>  	switch (port->dev->board) {
>  	case CX23885_BOARD_NETUP_DUAL_DVBS2_CI:
>  		netup_ci_exit(port);
> 
I wonder if the code above should be moved to before the
i2c_unregister_device block.
Currently these NETUP board drivers do not use "new style/i2c_client
based" frontend drivers. But if in future this switch is extended one
could get in trouble.

Regards
Matthias



[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux