From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Subject: [PATCH 3.10 45/64] [media] saa7134-alsa: Only frees registered sound cards
Date: Sun, 14 Feb 2016 14:23:17 -0800 [thread overview]
Message-ID: <20160214222222.706570799@linuxfoundation.org> (raw)
In-Reply-To: <20160214222221.031471863@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit ac75fe5d8fe4a0bf063be18fb29684405279e79e upstream.
That prevents this bug:
[ 2382.269496] BUG: unable to handle kernel NULL pointer dereference at 0000000000000540
[ 2382.270013] IP: [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
[ 2382.270013] PGD 0
[ 2382.270013] Oops: 0002 [#1] SMP
[ 2382.270013] Modules linked in: saa7134_alsa(-) tda1004x saa7134_dvb videobuf2_dvb dvb_core tda827x tda8290 tuner saa7134 tveeprom videobuf2_dma_sg videobuf2_memops videobuf2_v4l2 videobuf2_core v4l2_common videodev media auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc tun bridge stp llc ebtables ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack it87 hwmon_vid snd_hda_codec_idt snd_hda_codec_generic iTCO_wdt iTCO_vendor_support snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq pcspkr i2c_i801 snd_seq_device snd_pcm snd_timer lpc_ich snd mfd_core soundcore binfmt_misc i915 video i2c_algo_bit drm_kms_helper drm r8169 ata_generic serio_raw pata_acpi mii i2c_core [last unloaded: videobuf2_memops]
[ 2382.270013] CPU: 0 PID: 4899 Comm: rmmod Not tainted 4.5.0-rc1+ #4
[ 2382.270013] Hardware name: PCCHIPS P17G/P17G, BIOS 080012 05/14/2008
[ 2382.270013] task: ffff880039c38000 ti: ffff88003c764000 task.ti: ffff88003c764000
[ 2382.270013] RIP: 0010:[<ffffffffa01fe616>] [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
[ 2382.270013] RSP: 0018:ffff88003c767ea0 EFLAGS: 00010286
[ 2382.270013] RAX: ffff88003c767eb8 RBX: 0000000000000000 RCX: 0000000000006260
[ 2382.270013] RDX: ffffffffa020a060 RSI: ffffffffa0206de1 RDI: ffff88003c767eb0
[ 2382.270013] RBP: ffff88003c767ed8 R08: 0000000000019960 R09: ffffffff811a5412
[ 2382.270013] R10: ffffea0000d7c200 R11: 0000000000000000 R12: ffff88003c767ea8
[ 2382.270013] R13: 00007ffe760617f7 R14: 0000000000000000 R15: 0000557625d7f1e0
[ 2382.270013] FS: 00007f80bb1c0700(0000) GS:ffff88003f400000(0000) knlGS:0000000000000000
[ 2382.270013] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2382.270013] CR2: 0000000000000540 CR3: 000000003c00f000 CR4: 00000000000006f0
[ 2382.270013] Stack:
[ 2382.270013] 000000003c767ed8 ffffffff00000000 ffff880000000000 ffff88003c767eb8
[ 2382.270013] ffff88003c767eb8 ffffffffa049a890 00007ffe76060060 ffff88003c767ef0
[ 2382.270013] ffffffffa049889d ffffffffa049a500 ffff88003c767f48 ffffffff8111079c
[ 2382.270013] Call Trace:
[ 2382.270013] [<ffffffffa049889d>] saa7134_alsa_exit+0x1d/0x780 [saa7134_alsa]
[ 2382.270013] [<ffffffff8111079c>] SyS_delete_module+0x19c/0x1f0
[ 2382.270013] [<ffffffff8170fc2e>] entry_SYSCALL_64_fastpath+0x12/0x71
[ 2382.270013] Code: 20 a0 48 c7 c6 e1 6d 20 a0 48 89 e5 41 54 53 4c 8d 65 d0 48 89 fb 48 83 ec 28 c7 45 d0 00 00 00 00 49 8d 7c 24 08 e8 7a 55 ed e0 <4c> 89 a3 40 05 00 00 48 89 df e8 eb fd ff ff 85 c0 75 1a 48 8d
[ 2382.270013] RIP [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
[ 2382.270013] RSP <ffff88003c767ea0>
[ 2382.270013] CR2: 0000000000000540
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/saa7134/saa7134-alsa.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/media/pci/saa7134/saa7134-alsa.c
+++ b/drivers/media/pci/saa7134/saa7134-alsa.c
@@ -1145,6 +1145,8 @@ static int alsa_device_init(struct saa71
static int alsa_device_exit(struct saa7134_dev *dev)
{
+ if (!snd_saa7134_cards[dev->nr])
+ return 1;
snd_card_free(snd_saa7134_cards[dev->nr]);
snd_saa7134_cards[dev->nr] = NULL;
@@ -1194,7 +1196,8 @@ static void saa7134_alsa_exit(void)
int idx;
for (idx = 0; idx < SNDRV_CARDS; idx++) {
- snd_card_free(snd_saa7134_cards[idx]);
+ if (snd_saa7134_cards[idx])
+ snd_card_free(snd_saa7134_cards[idx]);
}
saa7134_dmasound_init = NULL;
next prev parent reply other threads:[~2016-02-14 22:56 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-14 22:22 [PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 01/64] recordmcount: Fix endianness handling bug for nop_mcount Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 02/64] xhci: fix placement of call to usb_disabled() Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 03/64] crypto: algif_hash - Only export and import on sockets with data Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 04/64] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 05/64] HID: usbhid: fix recursive deadlock Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 06/64] remoteproc: avoid stack overflow in debugfs file Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 07/64] kernel/signal.c: unexport sigsuspend() Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 08/64] ocfs2/dlm: ignore cleaning the migration mle that is inuse Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 09/64] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 10/64] sh64: fix __NR_fgetxattr Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 11/64] Revert "dm mpath: fix stalls when handling invalid ioctls" Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 12/64] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 13/64] spi: fix parent-device reference leak Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 14/64] wlcore/wl12xx: spi: fix oops on firmware load Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 15/64] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 16/64] vTPM: fix memory allocation flag for rtce buffer at kernel boot Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 17/64] mtd: mtdpart: fix add_mtd_partitions error path Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 18/64] jbd2: Fix unreclaimed pages after truncate in data=journal mode Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 19/64] [PATCH] fix calculation of meta_bg descriptor backups Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 20/64] parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 21/64] parisc: Fix syscall restarts Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 22/64] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 23/64] [media] v4l2-compat-ioctl32: fix alignment for ARM64 Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 24/64] [media] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 25/64] fix sysvfs symlinks Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 26/64] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 27/64] ALSA: usb-audio: avoid freeing umidi object twice Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 28/64] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 29/64] ALSA: dummy: Disable switching timer backend via sysfs Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 30/64] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 31/64] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 32/64] ALSA: rawmidi: Fix race at copying & updating the position Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 33/64] ALSA: pcm: Fix potential deadlock in OSS emulation Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 34/64] ASoC: dpcm: fix the BE state on hw_free Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 35/64] ALSA: seq: Fix yet another races among ALSA timer accesses Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 36/64] ALSA: seq: Fix race at closing in virmidi driver Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 37/64] ALSA: seq: Fix lockdep warnings due to double mutex locks Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 38/64] ALSA: timer: Code cleanup Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 39/64] ALSA: timer: Fix leftover link at closing Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 40/64] ALSA: timer: Fix link corruption due to double start or stop Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 41/64] ALSA: timer: Fix wrong instance passed to slave callbacks Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 42/64] ALSA: hda - Fix speaker output from VAIO AiO machines Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 43/64] ALSA: dummy: Implement timer backend switching more safely Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 44/64] ALSA: timer: Fix race between stop and interrupt Greg Kroah-Hartman
2016-02-14 22:23 ` Greg Kroah-Hartman [this message]
2016-02-14 22:23 ` [PATCH 3.10 46/64] USB: ti_usb_3410_502: Fix ID table size Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 47/64] USB: serial: visor: fix crash on detecting device without write_urbs Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 48/64] USB: visor: fix null-deref at probe Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 49/64] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 50/64] USB: cp210x: add ID for IAI USB to RS485 adaptor Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 51/64] USB: serial: option: Adding support for Telit LE922 Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 52/64] USB: option: fix Cinterion AHxx enumeration Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 53/64] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 54/64] ext4: Fix handling of extended tv_sec Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 55/64] crypto: af_alg - Disallow bind/setkey/... after accept(2) Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 56/64] crypto: af_alg - Fix socket double-free when accept fails Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 57/64] AHCI: Fix softreset failed issue of Port Multiplier Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 58/64] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 59/64] ahci: Intel DNV device IDs SATA Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 60/64] crypto: algif_hash - wait for crypto_ahash_init() to complete Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 61/64] EVM: Use crypto_memneq() for digest comparisons Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 62/64] crypto: user - lock crypto_alg_list on alg dump Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 63/64] FS-Cache: Increase reference of parent after registering, netfs success Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 64/64] binfmt_elf: Dont clobber passed executables file header Greg Kroah-Hartman
2016-02-15 5:20 ` [PATCH 3.10 00/64] 3.10.97-stable review Guenter Roeck
2016-02-15 18:12 ` Greg Kroah-Hartman
2016-02-15 15:46 ` Guenter Roeck
2016-02-15 17:13 ` Shuah Khan
2016-02-17 20:30 ` Greg Kroah-Hartman
2016-02-17 20:36 ` Shuah Khan
2016-02-17 23:26 ` Willy Tarreau
2016-02-17 23:33 ` Shuah Khan
2016-02-18 3:24 ` Shuah Khan
2016-02-18 3:24 ` Shuah Khan
2016-02-19 22:22 ` Greg Kroah-Hartman
2016-02-19 22:22 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160214222222.706570799@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@osg.samsung.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.