diff options
| author | Daniel Scheller <[email protected]> | 2017-08-23 12:09:59 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <[email protected]> | 2017-08-27 06:36:01 -0400 |
| commit | 1502efd2d5960c11593c5f002278cdc1e14c4520 (patch) | |
| tree | e89225904402f1db8ff54846dad4490938238f46 /lib/pm-notifier-error-inject.c | |
| parent | 6b852620fa75d3137929538b4a9aec2f953ff03c (diff) | |
media: ddbridge: fix teardown/deregistration order in ddb_input_detach()
Brought to attention by Matthias Schwarzott <[email protected]> by fixing
possible use-after-free faults in some demod drivers:
In ddb_input_detach(), the i2c_client is unregistered and removed before
dvb frontends are unregistered and detached. While no use-after-free issue
was observed so far, there is another issue with this:
dvb->attached keeps track of the state of the input/output registration,
and the i2c_client unregistration takes place only if everything was
successful (dvb->attached == 0x31). If for some reason an error occurred
during the frontend setup, that value stays at 0x20. In the following
error handling and cleanup, ddb_input_detach() will skip down to that
state, leaving the i2c_client registered, causing refcount issues.
Fix this by moving the i2c_client deregistration down to case 0x20.
Cc: Matthias Schwarzott <[email protected]>
Signed-off-by: Daniel Scheller <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Diffstat (limited to 'lib/pm-notifier-error-inject.c')
0 files changed, 0 insertions, 0 deletions