From patchwork Fri Jan 5 14:57:13 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brad Love X-Patchwork-Id: 10146659 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 876D6601A1 for ; Fri, 5 Jan 2018 14:57:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 75F88287BA for ; Fri, 5 Jan 2018 14:57:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6ADCF2882F; Fri, 5 Jan 2018 14:57:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0DE472845E for ; Fri, 5 Jan 2018 14:57:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752060AbeAEO5d (ORCPT ); Fri, 5 Jan 2018 09:57:33 -0500 Received: from sub5.mail.dreamhost.com ([208.113.200.129]:34162 "EHLO homiemail-a56.g.dreamhost.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751909AbeAEO51 (ORCPT ); Fri, 5 Jan 2018 09:57:27 -0500 Received: from homiemail-a56.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a56.g.dreamhost.com (Postfix) with ESMTP id 404F56004C1A; Fri, 5 Jan 2018 06:57:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=nextdimension.cc; h=from :to:cc:subject:date:message-id:in-reply-to:references; s= nextdimension.cc; bh=rJZx6Gq4G5LMxbpLAe6MVZpmgSY=; b=H9l+hnGrPE2 YxFB1mTEnIWdMao09sgcrcixKaFRruCINGvUF+VcGYY0FO7rJHbb5hh0H+dzGI/h y5nClId305A11yD7NGo3lxfDKYXaeAvfDed7LRxfNwwbieT+kSvj7H6UestZJJ+A numYBAW6XFw6AO4aHNrwWvCpAv2o4eZI= Received: from localhost.localdomain (66-90-189-166.dyn.grandenetworks.net [66.90.189.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: brad@nextdimension.ws) by homiemail-a56.g.dreamhost.com (Postfix) with ESMTPSA id F3EA16004C15; Fri, 5 Jan 2018 06:57:26 -0800 (PST) From: Brad Love To: linux-media@vger.kernel.org Cc: Brad Love Subject: [PATCH 2/2] lgdt3306a: Fix a double kfree on i2c device remove Date: Fri, 5 Jan 2018 08:57:13 -0600 Message-Id: <1515164233-2423-3-git-send-email-brad@nextdimension.cc> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1515164233-2423-1-git-send-email-brad@nextdimension.cc> References: <1515164233-2423-1-git-send-email-brad@nextdimension.cc> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Both lgdt33606a_release and lgdt3306a_remove kfree state, but _release is called first, then _remove operates on states members before kfree'ing it. This can lead to random oops/GPF/etc on USB disconnect. Signed-off-by: Brad Love --- drivers/media/dvb-frontends/lgdt3306a.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c index d370671..3642e6e 100644 --- a/drivers/media/dvb-frontends/lgdt3306a.c +++ b/drivers/media/dvb-frontends/lgdt3306a.c @@ -1768,7 +1768,13 @@ static void lgdt3306a_release(struct dvb_frontend *fe) struct lgdt3306a_state *state = fe->demodulator_priv; dbg_info("\n"); - kfree(state); + + /* + * If state->muxc is not NULL, then we are an i2c device + * and lgdt3306a_remove will clean up state + */ + if (!state->muxc) + kfree(state); } static const struct dvb_frontend_ops lgdt3306a_ops;