On 02/24/2015 10:29 AM, Devin Heitmueller wrote:
> This patch addresses a regression introduced in the following patch:
>
> commit 5264a522a597032c009f9143686ebf0fa4e244fb
> Author: Shuah Khan <shuahkh@xxxxxxxxxxxxxxx>
> Date: Mon Sep 22 21:30:46 2014 -0300
> [media] media: tuner xc5000 - release firmwware from xc5000_release()
>
> The "priv" struct is actually reference counted, so the xc5000_release()
> function gets called multiple times for hybrid devices. Because
> release_firmware() was always being called, it would work fine as expected
> on the first call but then the second call would corrupt aribtrary memory.
>
> Set the pointer to NULL after releasing so that we don't call
> release_firmware() twice.
>
> This problem was detected in the HVR-950q where plugging/unplugging the
> device multiple times would intermittently show panics in completely
> unrelated areas of the kernel.
Thanks for finding and fixing the problem.
>
> Signed-off-by: Devin Heitmueller <dheitmueller@xxxxxxxxxxxxxx>
> Cc: Shuah Khan <shuahkh@xxxxxxxxxxxxxxx>
> ---
> drivers/media/tuners/xc5000.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
> index 40f9db6..74b2092 100644
> --- a/drivers/media/tuners/xc5000.c
> +++ b/drivers/media/tuners/xc5000.c
> @@ -1314,7 +1314,10 @@ static int xc5000_release(struct dvb_frontend *fe)
>
> if (priv) {
> cancel_delayed_work(&priv->timer_sleep);
> - release_firmware(priv->firmware);
I would request you to add a comment here indicating the
hybrid case scenario to avoid any future cleanup type work
deciding there is no need to set priv->firmware to null
since priv gets released in hybrid_tuner_release_state(priv);
> + if (priv->firmware) {
> + release_firmware(priv->firmware);
> + priv->firmware = NULL;
> + }
> hybrid_tuner_release_state(priv);
> }
>
>
Adding Mauro as will to the thread. This should go into stable
as well.
thanks,
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@xxxxxxxxxxxxxxx | (970) 217-8978
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
