Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1424342

Re: [PATCH 1/3] drivers/media/dvb-core/en50221: use kref to manage struct dvb_ca_private

Show all headers | View raw

On 2016/06/16 18:06, Shuah Khan <shuahkh@osg.samsung.com> wrote:
> On 06/15/2016 02:15 PM, Max Kellermann wrote:
> > Don't free the object until the file handle has been closed.  Fixes
> > use-after-free bug which occurs when I disconnect my DVB-S received
> > while VDR is running.
> 
> Which file handle? /dev/dvb---

I don't know which one triggers it.  I get crashes with VDR, and VDR
opens all of them (ca0, demux0, frontend0), but won't release the file
handles even if they become defunct.  Only restarting the VDR process
leads to recovery (or crash).

> I think dvb_ca_en50221_release() and dvb_ca_en50221_io_do_ioctl()
> should serialize access to ca. dvb_ca_en50221_io_do_ioctl() holds
> the ioctl_mutex, however, dvb_ca_en50221_release() could happen while
> ioctl is in progress. Maybe you can try fixing those first.

True, there are LOTS of race conditions in the DVB code.  I see them
everywhere.  But that's orthogonal to my patch, isn't it?

> As I mentioned in my review on your 3/3 patch, adding a kref here
> adds more refcounted objects to the mix. You want to avoid that.

Mauro asked me to add the kref.  What is your suggestion to fix the
use-after-free bug?

I have a problem here, as mentioned in my last email: I don't know how
all of this is supposed to be, how it was designed; all I see is bugs
inside strange code, and I have to guess the previous author's
intentions and try to do the best to fix the code.

Max

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH 1/3] drivers/media/dvb-core/en50221: use kref to manage  struct dvb_ca_private Max Kellermann <max@duempel.org> - 2016-06-15 22:30 +0200
  [PATCH 2/3] drivers/media/media-entity: clear media_gobj.mdev in  _destroy() Max Kellermann <max@duempel.org> - 2016-06-15 22:30 +0200
    Re: [PATCH 2/3] drivers/media/media-entity: clear media_gobj.mdev in  _destroy() Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-16 18:30 +0200
      Re: [PATCH 2/3] drivers/media/media-entity: clear media_gobj.mdev in  _destroy() Max Kellermann <max@duempel.org> - 2016-06-16 20:50 +0200
        Re: [PATCH 2/3] drivers/media/media-entity: clear media_gobj.mdev in  _destroy() Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-16 21:00 +0200
    Re: [PATCH 2/3] drivers/media/media-entity: clear media_gobj.mdev in  _destroy() Sakari Ailus <sakari.ailus@iki.fi> - 2016-06-17 15:00 +0200
      Re: [PATCH 2/3] drivers/media/media-entity: clear media_gobj.mdev in  _destroy() Max Kellermann <max@duempel.org> - 2016-06-17 15:10 +0200
  Re: [PATCH 1/3] drivers/media/dvb-core/en50221: use kref to manage  struct dvb_ca_private Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-16 18:10 +0200
    Re: [PATCH 1/3] drivers/media/dvb-core/en50221: use kref to manage  struct dvb_ca_private Max Kellermann <max@duempel.org> - 2016-06-16 20:40 +0200

csiph-web