Messages in this thread | | | From | Andrey Konovalov <> | Date | Wed, 8 Nov 2017 17:04:44 +0100 | Subject | Re: usb/media/em28xx: use-after-free in em28xx_dvb_fini |
| |
On Wed, Nov 8, 2017 at 5:03 PM, Gustavo A. R. Silva <garsilva@embeddedor.com> wrote: > > Quoting Andrey Konovalov <andreyknvl@google.com>: > >> On Tue, Nov 7, 2017 at 10:18 PM, Gustavo A. R. Silva >> <garsilva@embeddedor.com> wrote: >>> >>> Hi Andrey, >>> >>> Could you please try this patch? >>> >>> Thank you >>> >>> Gustavo A. R. Silva >> >> >> Hi Gustavo, >> >> Still see the crash with your patch. >> >> Thanks! >> > > Thank you, Andrey. I will look into this further.
Since I'm able to reproduce this, I can apply a patch with debug printk's or something similar and run the reproducer. Send me a patch if you think it might help.
> > -- > Gustavo A. R. Silva > > >>> >>> --- >>> drivers/media/usb/em28xx/em28xx-dvb.c | 3 +++ >>> 1 file changed, 3 insertions(+) >>> >>> diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c >>> b/drivers/media/usb/em28xx/em28xx-dvb.c >>> index 4a7db62..fc3fb92 100644 >>> --- a/drivers/media/usb/em28xx/em28xx-dvb.c >>> +++ b/drivers/media/usb/em28xx/em28xx-dvb.c >>> @@ -2073,6 +2073,9 @@ static int em28xx_dvb_fini(struct em28xx *dev) >>> struct em28xx_dvb *dvb; >>> struct i2c_client *client; >>> >>> + if (!dev) >>> + return 0; >>> + >>> if (dev->is_audio_only) { >>> /* Shouldn't initialize IR for this interface */ >>> return 0; >>> -- >>> 2.7.4 >>> > > > > > >
| |