Message ID | 20141016075721.GC29096@mwanda (mailing list archive) |
---|---|
State | Accepted, archived |
Delegated to: | Hans Verkuil |
Headers |
Received: from mail.tu-berlin.de ([130.149.7.33]) by www.linuxtv.org with esmtp (Exim 4.72) (envelope-from <linux-media-owner@vger.kernel.org>) id 1Xefwg-0006Da-In; Thu, 16 Oct 2014 09:58:02 +0200 X-tubIT-Incoming-IP: 209.132.180.67 Received: from vger.kernel.org ([209.132.180.67]) by mail.tu-berlin.de (exim-4.72/mailfrontend-7) with esmtp id 1Xefwe-0006iB-0z; Thu, 16 Oct 2014 09:58:02 +0200 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751301AbaJPH54 (ORCPT <rfc822;mkrufky@linuxtv.org> + 1 other); Thu, 16 Oct 2014 03:57:56 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:24125 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750989AbaJPH5z (ORCPT <rfc822;linux-media@vger.kernel.org>); Thu, 16 Oct 2014 03:57:55 -0400 Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s9G7vjF9010280 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 16 Oct 2014 07:57:46 GMT Received: from userz7022.oracle.com (userz7022.oracle.com [156.151.31.86]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s9G7vhfe027495 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 16 Oct 2014 07:57:44 GMT Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by userz7022.oracle.com (8.14.5+Sun/8.14.4) with ESMTP id s9G7vg2E017821; Thu, 16 Oct 2014 07:57:43 GMT Received: from mwanda (/41.202.233.183) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 16 Oct 2014 00:57:41 -0700 Date: Thu, 16 Oct 2014 10:57:21 +0300 From: Dan Carpenter <dan.carpenter@oracle.com> To: Hans Verkuil <hverkuil@xs4all.nl> Cc: Mauro Carvalho Chehab <m.chehab@samsung.com>, "Lad, Prabhakar" <prabhakar.csengg@gmail.com>, Laurent Pinchart <laurent.pinchart@ideasonboard.com>, Sakari Ailus <sakari.ailus@linux.intel.com>, linux-media@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] [media] usbvision-video: two use after frees Message-ID: <20141016075721.GC29096@mwanda> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: <linux-media.vger.kernel.org> X-Mailing-List: linux-media@vger.kernel.org X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2014.10.16.74519 X-PMX-Spam: Gauge=IIIIIIIII, Probability=9%, Report=' MULTIPLE_RCPTS 0.1, HTML_00_01 0.05, HTML_00_10 0.05, MSGID_ADDED_BY_MTA 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1100_1199 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, INVALID_MSGID_NO_FQDN 0, URI_ENDS_IN_HTML 0, __ANY_URI 0, __CD 0, __CP_MEDIA_BODY 0, __CP_URI_IN_BODY 0, __CT 0, __CT_TEXT_PLAIN 0, __DATE_TZ_RU 0, __HAS_FROM 0, __HAS_MSGID 0, __HAS_X_MAILING_LIST 0, __MIME_TEXT_ONLY 0, __MIME_VERSION 0, __MULTIPLE_RCPTS_CC_X2 0, __SANE_MSGID 0, __SUBJ_ALPHA_END 0, __TO_MALFORMED_2 0, __URI_NO_WWW 0, __URI_NS , __USER_AGENT 0' |
Commit Message
Dan Carpenter
Oct. 16, 2014, 7:57 a.m. UTC
The lock has been freed in usbvision_release() so there is no need to
call mutex_unlock() here.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Comments
On Thursday 16 October 2014 10:57:21 Dan Carpenter wrote: > The lock has been freed in usbvision_release() so there is no need to > call mutex_unlock() here. Yuck :-/ The driver should really be converted to use video_device::release. That might be out of scope for this fix though. Is usbvision maintained ? > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > diff --git a/drivers/media/usb/usbvision/usbvision-video.c > b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041 > 100644 > --- a/drivers/media/usb/usbvision/usbvision-video.c > +++ b/drivers/media/usb/usbvision/usbvision-video.c > @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file) > if (usbvision->remove_pending) { > printk(KERN_INFO "%s: Final disconnect\n", __func__); > usbvision_release(usbvision); > + return 0; > } > mutex_unlock(&usbvision->v4l2_lock); > > @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file) > if (usbvision->remove_pending) { > printk(KERN_INFO "%s: Final disconnect\n", __func__); > usbvision_release(usbvision); > + return err_code; > } > > mutex_unlock(&usbvision->v4l2_lock);
On 10/16/2014 10:09 AM, Laurent Pinchart wrote: > On Thursday 16 October 2014 10:57:21 Dan Carpenter wrote: >> The lock has been freed in usbvision_release() so there is no need to >> call mutex_unlock() here. > > Yuck :-/ > > The driver should really be converted to use video_device::release. That might > be out of scope for this fix though. Is usbvision maintained ? I have hardware, and at some point I plan to convert it to modern frameworks. But ENOTIME for now. So I guess I might be the closest to a being a maintainer. Regards, Hans > >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> >> >> diff --git a/drivers/media/usb/usbvision/usbvision-video.c >> b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041 >> 100644 >> --- a/drivers/media/usb/usbvision/usbvision-video.c >> +++ b/drivers/media/usb/usbvision/usbvision-video.c >> @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file) >> if (usbvision->remove_pending) { >> printk(KERN_INFO "%s: Final disconnect\n", __func__); >> usbvision_release(usbvision); >> + return 0; >> } >> mutex_unlock(&usbvision->v4l2_lock); >> >> @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file) >> if (usbvision->remove_pending) { >> printk(KERN_INFO "%s: Final disconnect\n", __func__); >> usbvision_release(usbvision); >> + return err_code; >> } >> >> mutex_unlock(&usbvision->v4l2_lock); > -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thursday 16 October 2014 10:23:05 Hans Verkuil wrote: > On 10/16/2014 10:09 AM, Laurent Pinchart wrote: > > On Thursday 16 October 2014 10:57:21 Dan Carpenter wrote: > >> The lock has been freed in usbvision_release() so there is no need to > >> call mutex_unlock() here. > > > > Yuck :-/ > > > > The driver should really be converted to use video_device::release. That > > might be out of scope for this fix though. Is usbvision maintained ? > > I have hardware, and at some point I plan to convert it to modern > frameworks. But ENOTIME for now. So I guess I might be the closest to a > being a maintainer. Can you ack the patch then ? :-) > >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > >> > >> diff --git a/drivers/media/usb/usbvision/usbvision-video.c > >> b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041 > >> 100644 > >> --- a/drivers/media/usb/usbvision/usbvision-video.c > >> +++ b/drivers/media/usb/usbvision/usbvision-video.c > >> @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file) > >> if (usbvision->remove_pending) { > >> printk(KERN_INFO "%s: Final disconnect\n", __func__); > >> usbvision_release(usbvision); > >> + return 0; > >> } > >> mutex_unlock(&usbvision->v4l2_lock); > >> > >> @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file) > >> if (usbvision->remove_pending) { > >> printk(KERN_INFO "%s: Final disconnect\n", __func__); > >> usbvision_release(usbvision); > >> + return err_code; > >> } > >> > >> mutex_unlock(&usbvision->v4l2_lock);
diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041 100644 --- a/drivers/media/usb/usbvision/usbvision-video.c +++ b/drivers/media/usb/usbvision/usbvision-video.c @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file) if (usbvision->remove_pending) { printk(KERN_INFO "%s: Final disconnect\n", __func__); usbvision_release(usbvision); + return 0; } mutex_unlock(&usbvision->v4l2_lock); @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file) if (usbvision->remove_pending) { printk(KERN_INFO "%s: Final disconnect\n", __func__); usbvision_release(usbvision); + return err_code; } mutex_unlock(&usbvision->v4l2_lock);