* [patch] [media] usbvision-video: two use after frees
@ 2014-10-16 7:57 Dan Carpenter
2014-10-16 8:09 ` Laurent Pinchart
0 siblings, 1 reply; 4+ messages in thread
From: Dan Carpenter @ 2014-10-16 7:57 UTC (permalink / raw)
To: Hans Verkuil
Cc: Mauro Carvalho Chehab, Lad, Prabhakar, Laurent Pinchart,
Sakari Ailus, linux-media, kernel-janitors
The lock has been freed in usbvision_release() so there is no need to
call mutex_unlock() here.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index 68bc961..9bfa041 100644
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file)
if (usbvision->remove_pending) {
printk(KERN_INFO "%s: Final disconnect\n", __func__);
usbvision_release(usbvision);
+ return 0;
}
mutex_unlock(&usbvision->v4l2_lock);
@@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file)
if (usbvision->remove_pending) {
printk(KERN_INFO "%s: Final disconnect\n", __func__);
usbvision_release(usbvision);
+ return err_code;
}
mutex_unlock(&usbvision->v4l2_lock);
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [patch] [media] usbvision-video: two use after frees
2014-10-16 7:57 [patch] [media] usbvision-video: two use after frees Dan Carpenter
@ 2014-10-16 8:09 ` Laurent Pinchart
2014-10-16 8:23 ` Hans Verkuil
0 siblings, 1 reply; 4+ messages in thread
From: Laurent Pinchart @ 2014-10-16 8:09 UTC (permalink / raw)
To: Dan Carpenter
Cc: Hans Verkuil, Mauro Carvalho Chehab, Lad, Prabhakar, Sakari Ailus,
linux-media, kernel-janitors
On Thursday 16 October 2014 10:57:21 Dan Carpenter wrote:
> The lock has been freed in usbvision_release() so there is no need to
> call mutex_unlock() here.
Yuck :-/
The driver should really be converted to use video_device::release. That might
be out of scope for this fix though. Is usbvision maintained ?
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/media/usb/usbvision/usbvision-video.c
> b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041
> 100644
> --- a/drivers/media/usb/usbvision/usbvision-video.c
> +++ b/drivers/media/usb/usbvision/usbvision-video.c
> @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file)
> if (usbvision->remove_pending) {
> printk(KERN_INFO "%s: Final disconnect\n", __func__);
> usbvision_release(usbvision);
> + return 0;
> }
> mutex_unlock(&usbvision->v4l2_lock);
>
> @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file)
> if (usbvision->remove_pending) {
> printk(KERN_INFO "%s: Final disconnect\n", __func__);
> usbvision_release(usbvision);
> + return err_code;
> }
>
> mutex_unlock(&usbvision->v4l2_lock);
--
Regards,
Laurent Pinchart
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [patch] [media] usbvision-video: two use after frees
2014-10-16 8:09 ` Laurent Pinchart
@ 2014-10-16 8:23 ` Hans Verkuil
2014-10-16 8:25 ` Laurent Pinchart
0 siblings, 1 reply; 4+ messages in thread
From: Hans Verkuil @ 2014-10-16 8:23 UTC (permalink / raw)
To: Laurent Pinchart, Dan Carpenter
Cc: Mauro Carvalho Chehab, Lad, Prabhakar, Sakari Ailus, linux-media,
kernel-janitors
On 10/16/2014 10:09 AM, Laurent Pinchart wrote:
> On Thursday 16 October 2014 10:57:21 Dan Carpenter wrote:
>> The lock has been freed in usbvision_release() so there is no need to
>> call mutex_unlock() here.
>
> Yuck :-/
>
> The driver should really be converted to use video_device::release. That might
> be out of scope for this fix though. Is usbvision maintained ?
I have hardware, and at some point I plan to convert it to modern frameworks.
But ENOTIME for now. So I guess I might be the closest to a being a maintainer.
Regards,
Hans
>
>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>
>> diff --git a/drivers/media/usb/usbvision/usbvision-video.c
>> b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041
>> 100644
>> --- a/drivers/media/usb/usbvision/usbvision-video.c
>> +++ b/drivers/media/usb/usbvision/usbvision-video.c
>> @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file)
>> if (usbvision->remove_pending) {
>> printk(KERN_INFO "%s: Final disconnect\n", __func__);
>> usbvision_release(usbvision);
>> + return 0;
>> }
>> mutex_unlock(&usbvision->v4l2_lock);
>>
>> @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file)
>> if (usbvision->remove_pending) {
>> printk(KERN_INFO "%s: Final disconnect\n", __func__);
>> usbvision_release(usbvision);
>> + return err_code;
>> }
>>
>> mutex_unlock(&usbvision->v4l2_lock);
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [patch] [media] usbvision-video: two use after frees
2014-10-16 8:23 ` Hans Verkuil
@ 2014-10-16 8:25 ` Laurent Pinchart
0 siblings, 0 replies; 4+ messages in thread
From: Laurent Pinchart @ 2014-10-16 8:25 UTC (permalink / raw)
To: Hans Verkuil
Cc: Dan Carpenter, Mauro Carvalho Chehab, Lad, Prabhakar,
Sakari Ailus, linux-media, kernel-janitors
On Thursday 16 October 2014 10:23:05 Hans Verkuil wrote:
> On 10/16/2014 10:09 AM, Laurent Pinchart wrote:
> > On Thursday 16 October 2014 10:57:21 Dan Carpenter wrote:
> >> The lock has been freed in usbvision_release() so there is no need to
> >> call mutex_unlock() here.
> >
> > Yuck :-/
> >
> > The driver should really be converted to use video_device::release. That
> > might be out of scope for this fix though. Is usbvision maintained ?
>
> I have hardware, and at some point I plan to convert it to modern
> frameworks. But ENOTIME for now. So I guess I might be the closest to a
> being a maintainer.
Can you ack the patch then ? :-)
> >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> >>
> >> diff --git a/drivers/media/usb/usbvision/usbvision-video.c
> >> b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041
> >> 100644
> >> --- a/drivers/media/usb/usbvision/usbvision-video.c
> >> +++ b/drivers/media/usb/usbvision/usbvision-video.c
> >> @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file)
> >> if (usbvision->remove_pending) {
> >> printk(KERN_INFO "%s: Final disconnect\n", __func__);
> >> usbvision_release(usbvision);
> >> + return 0;
> >> }
> >> mutex_unlock(&usbvision->v4l2_lock);
> >>
> >> @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file)
> >> if (usbvision->remove_pending) {
> >> printk(KERN_INFO "%s: Final disconnect\n", __func__);
> >> usbvision_release(usbvision);
> >> + return err_code;
> >> }
> >>
> >> mutex_unlock(&usbvision->v4l2_lock);
--
Regards,
Laurent Pinchart
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-10-16 8:25 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-10-16 7:57 [patch] [media] usbvision-video: two use after frees Dan Carpenter
2014-10-16 8:09 ` Laurent Pinchart
2014-10-16 8:23 ` Hans Verkuil
2014-10-16 8:25 ` Laurent Pinchart
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox