Skip to contentSkip to conversation

xc5000: use after free in release()

PATCH In review Dan Carpenter 2 participants 5 messages Sep 25, 2014 – Oct 15, 2014

Subsystems (2)
Media (V4L/DVB) Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 xc5000: use after free in release()

I moved the call to hybrid_tuner_release_state(priv) after "priv->firmware" dereference.

Fixes 5264a522a597 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()')
Signed-off-by Dan Carpenter <[email protected]>
drivers/media/tuners/xc5000.c +1 -1
index e44c8ab..803a0e6 100644
@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe)
 
 	if (priv) {
 		cancel_delayed_work(&priv->timer_sleep);
-		hybrid_tuner_release_state(priv);
 		if (priv->firmware)
 			release_firmware(priv->firmware);
+		hybrid_tuner_release_state(priv);
 	}
 
 	mutex_unlock(&xc5000_list_mutex);
Reviewed-by on v1 1/1
#1 lore raw
Quoted 12 lines · Dan Carpenter

I moved the call to hybrid_tuner_release_state(priv) after "priv->firmware" dereference.

Fixes 5264a522a597 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()')
Signed-off-by Dan Carpenter <[email protected]>
drivers/media/tuners/xc5000.c +0 -0
index e44c8ab..803a0e6 100644

drivers/media/tuners/xc5000.c static int xc5000_release(struct dvb_frontend *fe) · line 1341

Quoted 10 lines
drivers/media/tuners/xc5000.c +1 -1
@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe)
 
 	if (priv) {
 		cancel_delayed_work(&priv->timer_sleep);
-		hybrid_tuner_release_state(priv);
 		if (priv->firmware)
 			release_firmware(priv->firmware);
+		hybrid_tuner_release_state(priv);
 	}
 
 	mutex_unlock(&xc5000_list_mutex);

Thanks for catching it.

Reviewed-by Shuah Khan <[email protected]>

-- Shuah

Signature · 4 lines
Shuah Khan
Sr. Linux Kernel Developer
Samsung Research America (Silicon Valley)
[email protected] | (970) 217-8978
author
#2 lore raw
In reply to Dan Carpenter
Quoted 4 lines · Dan Carpenter

I moved the call to hybrid_tuner_release_state(priv) after "priv->firmware" dereference.

Fixes 5264a522a597 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()')

We still need this patch.

regards,
dan carpenter

#3 lore raw
Quoted 8 lines · Dan Carpenter
Quoted 4 lines · Dan Carpenter

I moved the call to hybrid_tuner_release_state(priv) after "priv->firmware" dereference.

Fixes 5264a522a597 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()')

We still need this patch.

I didn't see it in media pull request for 3.18. Mauro probably has this on his list for next round.

-- Shuah

Signature · 4 lines
Shuah Khan
Sr. Linux Kernel Developer
Samsung Research America (Silicon Valley)
[email protected] | (970) 217-8978
author
#4 lore raw
Quoted 5 lines · Shuah Khan
Quoted 4 lines · Dan Carpenter
Quoted 3 lines · Dan Carpenter

I moved the call to hybrid_tuner_release_state(priv) after "priv->firmware" dereference.

Quoted 8 lines
Quoted 4 lines
Quoted 1 line
Fixes 5264a522a597 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()')

We still need this patch.

I didn't see it in media pull request for 3.18. Mauro probably has this on his list for next round.

It's not in linux-next.

regards,
dan carpenter