From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Subject: [PATCH 3.10 45/64] [media] saa7134-alsa: Only frees registered sound cards
Date: Sun, 14 Feb 2016 14:23:17 -0800 [thread overview]
Message-ID: <20160214222222.706570799@linuxfoundation.org> (raw)
In-Reply-To: <20160214222221.031471863@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit ac75fe5d8fe4a0bf063be18fb29684405279e79e upstream.
That prevents this bug:
[ 2382.269496] BUG: unable to handle kernel NULL pointer dereference at 0000000000000540
[ 2382.270013] IP: [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
[ 2382.270013] PGD 0
[ 2382.270013] Oops: 0002 [#1] SMP
[ 2382.270013] Modules linked in: saa7134_alsa(-) tda1004x saa7134_dvb videobuf2_dvb dvb_core tda827x tda8290 tuner saa7134 tveeprom videobuf2_dma_sg videobuf2_memops videobuf2_v4l2 videobuf2_core v4l2_common videodev media auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc tun bridge stp llc ebtables ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack it87 hwmon_vid snd_hda_codec_idt snd_hda_codec_generic iTCO_wdt iTCO_vendor_support snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq pcspkr i2c_i801 snd_seq_device snd_pcm snd_timer lpc_ich snd mfd_core soundcore binfmt_misc i915 video i2c_algo_bit drm_kms_helper drm r8169 ata_generic serio_raw pata_acpi mii i2c_core [last unloaded: videobuf2_memops]
[ 2382.270013] CPU: 0 PID: 4899 Comm: rmmod Not tainted 4.5.0-rc1+ #4
[ 2382.270013] Hardware name: PCCHIPS P17G/P17G, BIOS 080012 05/14/2008
[ 2382.270013] task: ffff880039c38000 ti: ffff88003c764000 task.ti: ffff88003c764000
[ 2382.270013] RIP: 0010:[<ffffffffa01fe616>] [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
[ 2382.270013] RSP: 0018:ffff88003c767ea0 EFLAGS: 00010286
[ 2382.270013] RAX: ffff88003c767eb8 RBX: 0000000000000000 RCX: 0000000000006260
[ 2382.270013] RDX: ffffffffa020a060 RSI: ffffffffa0206de1 RDI: ffff88003c767eb0
[ 2382.270013] RBP: ffff88003c767ed8 R08: 0000000000019960 R09: ffffffff811a5412
[ 2382.270013] R10: ffffea0000d7c200 R11: 0000000000000000 R12: ffff88003c767ea8
[ 2382.270013] R13: 00007ffe760617f7 R14: 0000000000000000 R15: 0000557625d7f1e0
[ 2382.270013] FS: 00007f80bb1c0700(0000) GS:ffff88003f400000(0000) knlGS:0000000000000000
[ 2382.270013] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2382.270013] CR2: 0000000000000540 CR3: 000000003c00f000 CR4: 00000000000006f0
[ 2382.270013] Stack:
[ 2382.270013] 000000003c767ed8 ffffffff00000000 ffff880000000000 ffff88003c767eb8
[ 2382.270013] ffff88003c767eb8 ffffffffa049a890 00007ffe76060060 ffff88003c767ef0
[ 2382.270013] ffffffffa049889d ffffffffa049a500 ffff88003c767f48 ffffffff8111079c
[ 2382.270013] Call Trace:
[ 2382.270013] [<ffffffffa049889d>] saa7134_alsa_exit+0x1d/0x780 [saa7134_alsa]
[ 2382.270013] [<ffffffff8111079c>] SyS_delete_module+0x19c/0x1f0
[ 2382.270013] [<ffffffff8170fc2e>] entry_SYSCALL_64_fastpath+0x12/0x71
[ 2382.270013] Code: 20 a0 48 c7 c6 e1 6d 20 a0 48 89 e5 41 54 53 4c 8d 65 d0 48 89 fb 48 83 ec 28 c7 45 d0 00 00 00 00 49 8d 7c 24 08 e8 7a 55 ed e0 <4c> 89 a3 40 05 00 00 48 89 df e8 eb fd ff ff 85 c0 75 1a 48 8d
[ 2382.270013] RIP [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
[ 2382.270013] RSP <ffff88003c767ea0>
[ 2382.270013] CR2: 0000000000000540
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/saa7134/saa7134-alsa.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/media/pci/saa7134/saa7134-alsa.c
+++ b/drivers/media/pci/saa7134/saa7134-alsa.c
@@ -1145,6 +1145,8 @@ static int alsa_device_init(struct saa71
static int alsa_device_exit(struct saa7134_dev *dev)
{
+ if (!snd_saa7134_cards[dev->nr])
+ return 1;
snd_card_free(snd_saa7134_cards[dev->nr]);
snd_saa7134_cards[dev->nr] = NULL;
@@ -1194,7 +1196,8 @@ static void saa7134_alsa_exit(void)
int idx;
for (idx = 0; idx < SNDRV_CARDS; idx++) {
- snd_card_free(snd_saa7134_cards[idx]);
+ if (snd_saa7134_cards[idx])
+ snd_card_free(snd_saa7134_cards[idx]);
}
saa7134_dmasound_init = NULL;
next prev parent reply other threads:[~2016-02-14 22:54 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-14 22:22 [PATCH 3.10 00/64] 3.10.97-stable review Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 01/64] recordmcount: Fix endianness handling bug for nop_mcount Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 02/64] xhci: fix placement of call to usb_disabled() Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 03/64] crypto: algif_hash - Only export and import on sockets with data Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 04/64] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 05/64] HID: usbhid: fix recursive deadlock Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 06/64] remoteproc: avoid stack overflow in debugfs file Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 07/64] kernel/signal.c: unexport sigsuspend() Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 08/64] ocfs2/dlm: ignore cleaning the migration mle that is inuse Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 09/64] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 10/64] sh64: fix __NR_fgetxattr Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 11/64] Revert "dm mpath: fix stalls when handling invalid ioctls" Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 12/64] spi: atmel: Fix DMA-setup for transfers with more than 8 bits per word Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 13/64] spi: fix parent-device reference leak Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 14/64] wlcore/wl12xx: spi: fix oops on firmware load Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 15/64] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 16/64] vTPM: fix memory allocation flag for rtce buffer at kernel boot Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 17/64] mtd: mtdpart: fix add_mtd_partitions error path Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 18/64] jbd2: Fix unreclaimed pages after truncate in data=journal mode Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 19/64] [PATCH] fix calculation of meta_bg descriptor backups Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 20/64] parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 21/64] parisc: Fix syscall restarts Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 22/64] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 23/64] [media] v4l2-compat-ioctl32: fix alignment for ARM64 Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 24/64] [media] media: vb2 dma-contig: Fully cache synchronise buffers in prepare and finish Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 25/64] fix sysvfs symlinks Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 26/64] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Greg Kroah-Hartman
2016-02-14 22:22 ` [PATCH 3.10 27/64] ALSA: usb-audio: avoid freeing umidi object twice Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 28/64] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 29/64] ALSA: dummy: Disable switching timer backend via sysfs Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 30/64] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 31/64] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 32/64] ALSA: rawmidi: Fix race at copying & updating the position Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 33/64] ALSA: pcm: Fix potential deadlock in OSS emulation Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 34/64] ASoC: dpcm: fix the BE state on hw_free Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 35/64] ALSA: seq: Fix yet another races among ALSA timer accesses Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 36/64] ALSA: seq: Fix race at closing in virmidi driver Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 37/64] ALSA: seq: Fix lockdep warnings due to double mutex locks Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 38/64] ALSA: timer: Code cleanup Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 39/64] ALSA: timer: Fix leftover link at closing Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 40/64] ALSA: timer: Fix link corruption due to double start or stop Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 41/64] ALSA: timer: Fix wrong instance passed to slave callbacks Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 42/64] ALSA: hda - Fix speaker output from VAIO AiO machines Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 43/64] ALSA: dummy: Implement timer backend switching more safely Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 44/64] ALSA: timer: Fix race between stop and interrupt Greg Kroah-Hartman
2016-02-14 22:23 ` Greg Kroah-Hartman [this message]
2016-02-14 22:23 ` [PATCH 3.10 46/64] USB: ti_usb_3410_502: Fix ID table size Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 47/64] USB: serial: visor: fix crash on detecting device without write_urbs Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 48/64] USB: visor: fix null-deref at probe Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 49/64] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 50/64] USB: cp210x: add ID for IAI USB to RS485 adaptor Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 51/64] USB: serial: option: Adding support for Telit LE922 Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 52/64] USB: option: fix Cinterion AHxx enumeration Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 53/64] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 54/64] ext4: Fix handling of extended tv_sec Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 55/64] crypto: af_alg - Disallow bind/setkey/... after accept(2) Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 56/64] crypto: af_alg - Fix socket double-free when accept fails Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 57/64] AHCI: Fix softreset failed issue of Port Multiplier Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 58/64] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 59/64] ahci: Intel DNV device IDs SATA Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 60/64] crypto: algif_hash - wait for crypto_ahash_init() to complete Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 61/64] EVM: Use crypto_memneq() for digest comparisons Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 62/64] crypto: user - lock crypto_alg_list on alg dump Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 63/64] FS-Cache: Increase reference of parent after registering, netfs success Greg Kroah-Hartman
2016-02-14 22:23 ` [PATCH 3.10 64/64] binfmt_elf: Dont clobber passed executables file header Greg Kroah-Hartman
2016-02-15 5:20 ` [PATCH 3.10 00/64] 3.10.97-stable review Guenter Roeck
2016-02-15 18:12 ` Greg Kroah-Hartman
2016-02-15 15:46 ` Guenter Roeck
2016-02-15 17:13 ` Shuah Khan
2016-02-17 20:30 ` Greg Kroah-Hartman
2016-02-17 20:36 ` Shuah Khan
2016-02-17 23:26 ` Willy Tarreau
2016-02-17 23:33 ` Shuah Khan
2016-02-18 3:24 ` Shuah Khan
2016-02-19 22:22 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160214222222.706570799@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@osg.samsung.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).