mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-28 07:13:34 +00:00
Code Issues Releases Wiki Activity
linux-stable/drivers/media/usb/cx231xx
History
Matthias Schwarzott e59eb4adf0 media: cx231xx: fix use-after-free when unregistering the i2c_client for the dvb demod 
Calling i2c_unregister_device for a demod driver destroys the frontend object.
Later it is accessed by calling dvb_unregister_frontend and
dvb_frontend_detach.

In some cases this leads to a general protection fault with this
callstack:

  dvb_unregister_frontend+0x25/0x50 [dvb_core]
  dvb_fini+0xdb/0x160 [cx231xx_dvb]
  cx231xx_unregister_extension+0x3d/0xb0 [cx231xx]
  cx231xx_dvb_unregister+0x10/0x809 [cx231xx_dvb]
  SyS_delete_module+0x18a/0x240
  ? exit_to_usermode_loop+0x7b/0x80
  entry_SYSCALL_64_fastpath+0x17/0x98

Signed-off-by: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-08-27 06:33:47 -04:00
..
cx231xx-417.c media: cx231xx: constify videobuf_queue_ops structures 2017-08-20 08:06:58 -04:00
cx231xx-audio.c media: usb: make snd_pcm_hardware const 2017-08-20 08:05:10 -04:00
cx231xx-avcore.c [media] cx231xx: don't return error on success 2016-09-05 15:26:30 -03:00
cx231xx-cards.c [media] cx231xx: Initial support Astrometa T2hybrid 2017-06-06 07:53:26 -03:00
cx231xx-conf-reg.h
cx231xx-core.c media: cx231xx: only unregister successfully registered i2c adapters 2017-08-09 11:03:13 -04:00
cx231xx-dif.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
cx231xx-dvb.c media: cx231xx: fix use-after-free when unregistering the i2c_client for the dvb demod 2017-08-27 06:33:47 -04:00
cx231xx-i2c.c media: usb: make i2c_adapter const 2017-08-26 08:41:58 -04:00
cx231xx-input.c media: rc: rename RC_TYPE_* to RC_PROTO_* and RC_BIT_* to RC_PROTO_BIT_* 2017-08-20 10:02:48 -04:00
cx231xx-pcb-cfg.c
cx231xx-pcb-cfg.h
cx231xx-reg.h
cx231xx-vbi.c [media] media: usb: cx231xx: cx231xx-vbi: don't print error when allocating urb fails 2016-08-24 08:49:55 -03:00
cx231xx-vbi.h
cx231xx-video.c media: cx231xx: constify videobuf_queue_ops structures 2017-08-20 08:06:58 -04:00
cx231xx.h media: cx231xx: drop return value of cx231xx_i2c_unregister 2017-08-09 10:17:00 -04:00
Kconfig [media] cx231xx: Initial support Astrometa T2hybrid 2017-06-06 07:53:26 -03:00
Makefile