[PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'

[PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'

[Lee Jones]

A pointer to 'struct si470x_device' is currently used after free:

  drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
    preceded by free on line 460

Shift the call to free() down past its final use.

NB: Not sending to Mainline, since the problem does not exist there.

Cc: <stable@vger.kernel.org> # v3.18+
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
---
 drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index ae7540b765e1d..aa12fd2663895 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -483,10 +483,10 @@ static int si470x_i2c_remove(struct i2c_client *client)
 
 	free_irq(client->irq, radio);
 	video_unregister_device(&radio->videodev);
-	kfree(radio);
 
 	v4l2_ctrl_handler_free(&radio->hdl);
 	v4l2_device_unregister(&radio->v4l2_dev);
+	kfree(radio);
 	return 0;
 }
 
-- 
2.24.0

Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'

[Greg KH]

On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> A pointer to 'struct si470x_device' is currently used after free:
> 
>   drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
>     preceded by free on line 460
> 
> Shift the call to free() down past its final use.
> 
> NB: Not sending to Mainline, since the problem does not exist there.

It doesn't exist there because of a bad merge?  What commit caused the
problem?

thanks,

greg k-h

Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'

[Greg KH]

On Mon, Feb 03, 2020 at 02:32:45PM +0000, Greg KH wrote:
> On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> > A pointer to 'struct si470x_device' is currently used after free:
> > 
> >   drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
> >     preceded by free on line 460
> > 
> > Shift the call to free() down past its final use.
> > 
> > NB: Not sending to Mainline, since the problem does not exist there.
> 
> It doesn't exist there because of a bad merge?  What commit caused the
> problem?

Ah, found it, it was 2df200ab234a ("media: si470x-i2c: add missed
operations in remove")

Re: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'

[Lee Jones]

On Mon, 03 Feb 2020, Greg KH wrote:

> On Mon, Feb 03, 2020 at 02:32:45PM +0000, Greg KH wrote:
> > On Mon, Feb 03, 2020 at 01:21:30PM +0000, Lee Jones wrote:
> > > A pointer to 'struct si470x_device' is currently used after free:
> > > 
> > >   drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
> > >     preceded by free on line 460
> > > 
> > > Shift the call to free() down past its final use.
> > > 
> > > NB: Not sending to Mainline, since the problem does not exist there.
> > 
> > It doesn't exist there because of a bad merge?  What commit caused the
> > problem?
> 
> Ah, found it, it was 2df200ab234a ("media: si470x-i2c: add missed
> operations in remove")

I was about to follow up with a v2:

  "NB: Cauased during the backporting of upstream commit 2df200ab234a
   ("media: si470x-i2c: add missed operations in remove").  This issue does
   not exist in Mainline since the kfree() was removed in v5.0 as part of
   commit f86c51b66bf6 ("media: si470x-i2c: Use managed resource helpers")."

-- 
Lee Jones [李琼斯]
Linaro Services Technical Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog