lkml.org 
[lkml]   [2016]   [Jun]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 1/3] drivers/media/dvb-core/en50221: use kref to manage struct dvb_ca_private
From
Date
On 06/15/2016 02:15 PM, Max Kellermann wrote:
> Don't free the object until the file handle has been closed. Fixes
> use-after-free bug which occurs when I disconnect my DVB-S received
> while VDR is running.

Which file handle? /dev/dvb---

There seems to be a problem in the driver release routine:
dvb_ca_en50221_release() routine:

kfree(ca->slot_info);
dvb_unregister_device(ca->dvbdev);
kfree(ca);

I think this should be since ioctl references slot info

dvb_unregister_device(ca->dvbdev);
kfree(ca->slot_info);
kfree(ca);

I think dvb_ca_en50221_release() and dvb_ca_en50221_io_do_ioctl()
should serialize access to ca. dvb_ca_en50221_io_do_ioctl() holds
the ioctl_mutex, however, dvb_ca_en50221_release() could happen while
ioctl is in progress. Maybe you can try fixing those first.

As I mentioned in my review on your 3/3 patch, adding a kref here
adds more refcounted objects to the mix. You want to avoid that.

thanks,
-- Shuah

\
 
 \ /
  Last update: 2016-06-16 18:41    [W:0.110 / U:7.368 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site