Re: [PATCH] xc5000: fix memory corruption when unplugging device

[Shuah Khan <shuahkh@osg.samsung.com>]

On 02/24/2015 10:29 AM, Devin Heitmueller wrote:
> This patch addresses a regression introduced in the following patch:
> 
> commit 5264a522a597032c009f9143686ebf0fa4e244fb
> Author: Shuah Khan <shuahkh@osg.samsung.com>
> Date:   Mon Sep 22 21:30:46 2014 -0300
>     [media] media: tuner xc5000 - release firmwware from xc5000_release()
> 
> The "priv" struct is actually reference counted, so the xc5000_release()
> function gets called multiple times for hybrid devices.  Because
> release_firmware() was always being called, it would work fine as expected
> on the first call but then the second call would corrupt aribtrary memory.
> 
> Set the pointer to NULL after releasing so that we don't call
> release_firmware() twice.
> 
> This problem was detected in the HVR-950q where plugging/unplugging the
> device multiple times would intermittently show panics in completely
> unrelated areas of the kernel.

Thanks for finding and fixing the problem.

> 
> Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com>
> Cc: Shuah Khan <shuahkh@osg.samsung.com>
> ---
>  drivers/media/tuners/xc5000.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
> index 40f9db6..74b2092 100644
> --- a/drivers/media/tuners/xc5000.c
> +++ b/drivers/media/tuners/xc5000.c
> @@ -1314,7 +1314,10 @@ static int xc5000_release(struct dvb_frontend *fe)
>  
>  	if (priv) {
>  		cancel_delayed_work(&priv->timer_sleep);
> -		release_firmware(priv->firmware);

I would request you to add a comment here indicating the
hybrid case scenario to avoid any future cleanup type work
deciding there is no need to set priv->firmware to null
since priv gets released in hybrid_tuner_release_state(priv);


> +		if (priv->firmware) {
> +			release_firmware(priv->firmware);
> +			priv->firmware = NULL;
> +		}
>  		hybrid_tuner_release_state(priv);
>  	}
>  
> 

Adding Mauro as will to the thread. This should go into stable
as well.

thanks,
-- Shuah

-- 
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978