lkml.org 
[lkml]   [2020]   [Apr]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 090/232] media: ti-vpe: cal: fix a kernel oops when unloading module
    Date
    From: Benoit Parrot <bparrot@ti.com>

    commit 80264809ea0a3fd2ee8251f31a9eb85d2c3fc77e upstream.

    After the switch to use v4l2_async_notifier_add_subdev() and
    v4l2_async_notifier_cleanup(), unloading the ti_cal module would cause a
    kernel oops.

    This was root cause to the fact that v4l2_async_notifier_cleanup() tries
    to kfree the asd pointer passed into v4l2_async_notifier_add_subdev().

    In our case the asd reference was from a statically allocated struct.
    So in effect v4l2_async_notifier_cleanup() was trying to free a pointer
    that was not kalloc.

    So here we switch to using a kzalloc struct instead of a static one.
    To achieve this we re-order some of the calls to prevent asd allocation
    from leaking.

    Fixes: d079f94c9046 ("media: platform: Switch to v4l2_async_notifier_add_subdev")
    Cc: stable@vger.kernel.org
    Signed-off-by: Benoit Parrot <bparrot@ti.com>
    Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/platform/ti-vpe/cal.c | 13 ++++++++-----
    1 file changed, 8 insertions(+), 5 deletions(-)

    --- a/drivers/media/platform/ti-vpe/cal.c
    +++ b/drivers/media/platform/ti-vpe/cal.c
    @@ -266,8 +266,6 @@ struct cal_ctx {
    struct v4l2_subdev *sensor;
    struct v4l2_fwnode_endpoint endpoint;

    - struct v4l2_async_subdev asd;
    -
    struct v4l2_fh fh;
    struct cal_dev *dev;
    struct cc_data *cc;
    @@ -1648,7 +1646,6 @@ static int of_cal_create_instance(struct

    parent = pdev->dev.of_node;

    - asd = &ctx->asd;
    endpoint = &ctx->endpoint;

    ep_node = NULL;
    @@ -1695,8 +1692,6 @@ static int of_cal_create_instance(struct
    ctx_dbg(3, ctx, "can't get remote parent\n");
    goto cleanup_exit;
    }
    - asd->match_type = V4L2_ASYNC_MATCH_FWNODE;
    - asd->match.fwnode = of_fwnode_handle(sensor_node);

    v4l2_fwnode_endpoint_parse(of_fwnode_handle(ep_node), endpoint);

    @@ -1726,9 +1721,17 @@ static int of_cal_create_instance(struct

    v4l2_async_notifier_init(&ctx->notifier);

    + asd = kzalloc(sizeof(*asd), GFP_KERNEL);
    + if (!asd)
    + goto cleanup_exit;
    +
    + asd->match_type = V4L2_ASYNC_MATCH_FWNODE;
    + asd->match.fwnode = of_fwnode_handle(sensor_node);
    +
    ret = v4l2_async_notifier_add_subdev(&ctx->notifier, asd);
    if (ret) {
    ctx_err(ctx, "Error adding asd\n");
    + kfree(asd);
    goto cleanup_exit;
    }


    \
     
     \ /
      Last update: 2020-04-16 17:20    [W:4.290 / U:0.456 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site