Skip to content

Fix leaks in rc core

Sean Young bpf kernel-janitors linux-amlogic linux-arm-kernel linux-media linux-sunxi lkml stable 5 versions – In review

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v5 Latest15 patches 3 repliesIn review
  2. v415 patches 11 repliesSuperseded
  3. v313 patches 0 repliesSuperseded
Earlier versions · 2
VersionPostedPatchesRepliesStatus
v211 patches1 replySuperseded
v17 patches2 repliesSuperseded

Changes in v5 from the cover letter

- media: redrat3: Error path leaves device in transmitting state
- this now removes the check for transmitting boolean in transmit as it is now redundant.
- Reworded commit message
- media: rc: Use after free in ir_raw_event_handle()
- media: rc: Fix race condition during rc_register_device()
- Reworded commit message
- commits affecting particular modules are sorted together

Patches in v5 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/15media: streamzap: Add missing rc_unregister_device()drivers/media/rc/streamzap.c+1 -00 replies
2/15media: redrat3: Ensure rc device is freed if enable_detector() failsdrivers/media/rc/redrat3.c+9 -30 replies
3/15media: redrat3: Ensure we don't read beyond the end of the packetdrivers/media/rc/redrat3.c+16 -00 replies
4/15media: redrat3: Ensure all urbs are suspendeddrivers/media/rc/redrat3.c+1 -00 replies
5/15media: redrat3: Error path leaves device in transmitting statedrivers/media/rc/redrat3.c+3 -82 replies
6/15media: sunxi-cir: Ensure no more interrupts can occur before freedrivers/media/rc/sunxi-cir.c+1 -10 replies
7/15media: meson-ir-tx: Ensure clock is disabled on unbinddrivers/media/rc/meson-ir-tx.c+2 -20 replies
8/15media: meson-ir-tx: Ensure rc_free_device() is called on unbinddrivers/media/rc/meson-ir-tx.c+2 -40 replies
9/15media: meson-ir-tx: Ensure probe error is propagateddrivers/media/rc/meson-ir-tx.c+2 -20 replies
10/15media: ir-hix5hd2: Ensure rdev is setup before interrupts are enableddrivers/media/rc/ir-hix5hd2.c+3 -20 replies
11/15media: cx88: Specify rc type at rc_allocate_type()drivers/media/pci/cx88/cx88-input.c+12 -100 replies
12/15media: saa7134: Specify rc type at rc_allocate_type()drivers/media/pci/saa7134/saa7134-input.c+3 -40 replies
13/15media: rc: Fix race condition during rc_register_device()drivers/media/rc/rc-ir-raw.c drivers/media/rc/rc-main.c+12 -270 replies
14/15media: rc: Use after free in ir_raw_event_handle()drivers/media/rc/rc-ir-raw.c+14 -20 replies
15/15media: rc: Fix use after free in bpf progsdrivers/media/rc/bpf-lirc.c drivers/media/rc/rc-ir-raw.c+16 -130 replies

Reviews trailers per patch

3 of 15 patches have a Reviewed-by or Acked-by of their own; the series has one for all of them.

PatchMartin BlumenstinglNeil ArmstrongHans Verkuil
SeriesR-b
1/15
2/15
3/15
4/15
5/15
6/15
7/15R-b
8/15R-b R-b
9/15R-b R-b
10/15
11/15
12/15
13/15
14/15
15/15

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.

Read the v5 thread

Cover letter [PATCH v5 00/15] Fix leaks in rc core

Changes since v4:
- media: redrat3: Error path leaves device in transmitting state
- this now removes the check for transmitting boolean in transmit as it is now redundant.
- Reworded commit message
- media: rc: Use after free in ir_raw_event_handle()
- media: rc: Fix race condition during rc_register_device()
- Reworded commit message
- commits affecting particular modules are sorted together

Changes since v3:
- sashiko had many more good review comments

Changes since v2:
- sashiko had many more good review comments

Changes since v1:
- sashiko had many good review comments
- Added fix rc: Use after free in ir_raw_event_handle()
- Added fix meson-ir-tx: Ensure probe error is propagated
- Added fix redrat3: Ensure all urbs are suspended
- Added fix media: redrat3: Error path leaves device in transmitting state
- streamzap fix was incorrect
- Other minor fixes

Sean Young (15):
media: streamzap: Add missing rc_unregister_device()
media: redrat3: Ensure rc device is freed if enable_detector() fails
media: redrat3: Ensure we don't read beyond the end of the packet
media: redrat3: Ensure all urbs are suspended
media: redrat3: Error path leaves device in transmitting state
media: sunxi-cir: Ensure no more interrupts can occur before free
media: meson-ir-tx: Ensure clock is disabled on unbind
media: meson-ir-tx: Ensure rc_free_device() is called on unbind
media: meson-ir-tx: Ensure probe error is propagated
media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled
media: cx88: Specify rc type at rc_allocate_type()
media: saa7134: Specify rc type at rc_allocate_type()
media: rc: Fix race condition during rc_register_device()
media: rc: Use after free in ir_raw_event_handle()
media: rc: Fix use after free in bpf progs

 drivers/media/pci/cx88/cx88-input.c       | 22 ++++++-----
 drivers/media/pci/saa7134/saa7134-input.c |  7 ++--
 drivers/media/rc/bpf-lirc.c               | 18 ++++++---
 drivers/media/rc/ir-hix5hd2.c             |  5 ++-
 drivers/media/rc/meson-ir-tx.c            | 14 +++----
 drivers/media/rc/rc-ir-raw.c              | 47 +++++++++--------------
 drivers/media/rc/rc-main.c                | 19 +++++----
 drivers/media/rc/redrat3.c                | 40 +++++++++++++------
 drivers/media/rc/streamzap.c              |  1 +
 drivers/media/rc/sunxi-cir.c              |  2 +-
 10 files changed, 97 insertions(+), 78 deletions(-)
Signature · 1 line
2.55.0