Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1423406
| From | Max Kellermann <max@duempel.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3/3] drivers/media/media-device: fix double free bug in _unregister() |
| Date | 2016-06-15 22:30 +0200 |
| Message-ID | <rKpBL-7cb-5@gated-at.bofh.it> (permalink) |
| References | <rKpBL-7cb-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
While removing all interfaces in media_device_unregister(), all
media_interface pointers are freed. This is illegal and results in
double kfree() if any media_interface is still linked at this point;
maybe because a userspace process still has a file handle. Once the
process closes the file handle, dvb_media_device_free() gets called,
which frees the dvb_device.intf_devnode again.
This patch removes the unnecessary kfree() call, and documents who's
responsible for really freeing it.
Signed-off-by: Max Kellermann <max@duempel.org>
---
drivers/media/media-device.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
index 33a9952..1db4707 100644
--- a/drivers/media/media-device.c
+++ b/drivers/media/media-device.c
@@ -799,9 +799,11 @@ void media_device_unregister(struct media_device *mdev)
/* Remove all interfaces from the media device */
list_for_each_entry_safe(intf, tmp_intf, &mdev->interfaces,
graph_obj.list) {
+ /* unlink the interface, but don't free it here; the
+ module which created it is responsible for freeing
+ it */
__media_remove_intf_links(intf);
media_gobj_destroy(&intf->graph_obj);
- kfree(intf);
}
mutex_unlock(&mdev->graph_mutex);
Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread
[PATCH 3/3] drivers/media/media-device: fix double free bug in _unregister() Max Kellermann <max@duempel.org> - 2016-06-15 22:30 +0200
Re: [PATCH 3/3] drivers/media/media-device: fix double free bug in _unregister() Max Kellermann <max@duempel.org> - 2016-06-15 22:40 +0200
Re: [PATCH 3/3] drivers/media/media-device: fix double free bug in _unregister() Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-16 00:00 +0200
Re: [PATCH 3/3] drivers/media/media-device: fix double free bug in _unregister() Max Kellermann <max@duempel.org> - 2016-06-16 11:30 +0200
Re: [PATCH 3/3] drivers/media/media-device: fix double free bug in _unregister() Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-16 15:50 +0200
Re: [PATCH 3/3] drivers/media/media-device: fix double free bug in _unregister() Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-15 22:40 +0200
csiph-web