From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Brad Love <brad@nextdimension.cc>,
Michael Ira Krufky <mkrufky@gmail.com>,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 4.14 73/89] media: em28xx: Fix DualHD disconnect oops
Date: Sun, 2 Sep 2018 13:07:38 +0000 [thread overview]
Message-ID: <20180902064918.183387-73-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20180902064918.183387-1-alexander.levin@microsoft.com>
From: Brad Love <brad@nextdimension.cc>
[ Upstream commit 20cdcaf903298d54b834daedf65a2ddef70cae0a ]
During the duplication of em28xx state for the second tuner pair
a pointer to alt_max_pkt_size_isoc is copied. During tear down
the second tuner is destroyed first and kfrees alt_max_pkt_size_isoc,
then the first tuner is destroyed and kfrees it again. The property
should only be kfree'd if the tuner is PRIMARY_TS.
[ 354.888560] ------------[ cut here ]------------
[ 354.888562] kernel BUG at mm/slub.c:296!
[ 354.888574] invalid opcode: 0000 [#1] SMP NOPTI
[ 354.888869] CPU: 1 PID: 19 Comm: kworker/1:0 Not tainted 4.18.0-rc1+ #20
[ 354.889140] Hardware name: MSI MS-7A39/B350M GAMING PRO (MS-7A39), BIOS 2.G0 04/27/2018
[ 354.889408] Workqueue: usb_hub_wq hub_event
[ 354.889679] RIP: 0010:__slab_free+0x217/0x370
[ 354.889942] Code: bb c0 e8 07 41 38 c7 72 39 48 83 c4 70 5b 41 5a 41 5c 41 5d 41 5e 41 5f 5d 49 8d 62 f8 c3 f3 90 49 8b 04 24 a8 01 75 f6 eb 82 <0f> 0b 44 89 45 80 48 89 4d 88 e8 aa fa ff ff 85 c0 74 cc e9 b7 fe
[ 354.890598] RSP: 0018:ffffb84c41a4fad0 EFLAGS: 00010246
[ 354.890934] RAX: ffff948646e85150 RBX: ffff948646e85150 RCX: ffff948646e85150
[ 354.891280] RDX: 00000000820001d9 RSI: fffffa8fd01ba140 RDI: ffff94865e807c00
[ 354.891649] RBP: ffffb84c41a4fb70 R08: 0000000000000001 R09: ffffffffc059ce21
[ 354.892025] R10: ffff948646e85150 R11: 0000000000000001 R12: fffffa8fd01ba140
[ 354.892403] R13: ffff948646e85150 R14: ffff94865e807c00 R15: ffff94864c92e0a0
[ 354.892780] FS: 0000000000000000(0000) GS:ffff94865ec40000(0000) knlGS:0000000000000000
[ 354.893150] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 354.893530] CR2: 00007f4e476da950 CR3: 000000040112c000 CR4: 00000000003406e0
[ 354.893917] Call Trace:
[ 354.894315] ? __dev_printk+0x3c/0x80
[ 354.894695] ? _dev_info+0x64/0x80
[ 354.895082] ? em28xx_free_device+0x41/0x50 [em28xx]
[ 354.895464] kfree+0x17a/0x190
[ 354.895852] ? kfree+0x17a/0x190
[ 354.896310] em28xx_free_device+0x41/0x50 [em28xx]
[ 354.896698] em28xx_usb_disconnect+0xfa/0x110 [em28xx]
[ 354.897083] usb_unbind_interface+0x7a/0x270
[ 354.897475] device_release_driver_internal+0x17c/0x250
[ 354.897864] device_release_driver+0x12/0x20
[ 354.898252] bus_remove_device+0xec/0x160
[ 354.898639] device_del+0x13d/0x320
[ 354.899018] ? usb_remove_ep_devs+0x1f/0x30
[ 354.899392] usb_disable_device+0x9e/0x270
[ 354.899772] usb_disconnect+0x92/0x2a0
[ 354.900149] hub_event+0x98e/0x1650
[ 354.900519] ? sched_clock_cpu+0x11/0xa0
[ 354.900890] process_one_work+0x167/0x3f0
[ 354.901251] worker_thread+0x4d/0x460
[ 354.901610] kthread+0x105/0x140
[ 354.901964] ? rescuer_thread+0x360/0x360
[ 354.902318] ? kthread_associate_blkcg+0xa0/0xa0
[ 354.902672] ret_from_fork+0x22/0x40
[ 354.903024] Modules linked in: rc_hauppauge em28xx_rc rc_core si2157 lgdt3306a i2c_mux em28xx_dvb dvb_core videobuf2_vmalloc videobuf2_memops videobuf2_common snd_hda_codec_hdmi nls_iso8859_1 edac_mce_amd kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi aesni_intel snd_seq_midi_event aes_x86_64 snd_rawmidi crypto_simd em28xx cryptd glue_helper asix tveeprom usbnet snd_seq v4l2_common mii videodev snd_seq_device media input_leds snd_timer joydev ccp k10temp wmi_bmof snd soundcore mac_hid sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables vfio_pci vfio_virqfd irqbypass vfio_iommu_type1 vfio nouveau mxm_wmi video i2c_algo_bit ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops i2c_piix4 drm ahci libahci
[ 354.905129] wmi gpio_amdpt gpio_generic hid_generic usbhid hid
[ 354.908140] ---[ end trace c230d02716298c34 ]---
[ 354.908145] RIP: 0010:__slab_free+0x217/0x370
[ 354.908147] Code: bb c0 e8 07 41 38 c7 72 39 48 83 c4 70 5b 41 5a 41 5c 41 5d 41 5e 41 5f 5d 49 8d 62 f8 c3 f3 90 49 8b 04 24 a8 01 75 f6 eb 82 <0f> 0b 44 89 45 80 48 89 4d 88 e8 aa fa ff ff 85 c0 74 cc e9 b7 fe
[ 354.908183] RSP: 0018:ffffb84c41a4fad0 EFLAGS: 00010246
[ 354.908186] RAX: ffff948646e85150 RBX: ffff948646e85150 RCX: ffff948646e85150
[ 354.908189] RDX: 00000000820001d9 RSI: fffffa8fd01ba140 RDI: ffff94865e807c00
[ 354.908191] RBP: ffffb84c41a4fb70 R08: 0000000000000001 R09: ffffffffc059ce21
[ 354.908193] R10: ffff948646e85150 R11: 0000000000000001 R12: fffffa8fd01ba140
[ 354.908195] R13: ffff948646e85150 R14: ffff94865e807c00 R15: ffff94864c92e0a0
[ 354.908198] FS: 0000000000000000(0000) GS:ffff94865ec40000(0000) knlGS:0000000000000000
[ 354.908201] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 354.908203] CR2: 00007f4e476da950 CR3: 000000016b20a000 CR4: 00000000003406e0
Signed-off-by: Brad Love <brad@nextdimension.cc>
Signed-off-by: Michael Ira Krufky <mkrufky@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
drivers/media/usb/em28xx/em28xx-cards.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 11a59854a0a6..f88a65b650f9 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3276,7 +3276,9 @@ void em28xx_free_device(struct kref *ref)
if (!dev->disconnected)
em28xx_release_resources(dev);
- kfree(dev->alt_max_pkt_size_isoc);
+ if (dev->ts == PRIMARY_TS)
+ kfree(dev->alt_max_pkt_size_isoc);
+
kfree(dev);
}
EXPORT_SYMBOL_GPL(em28xx_free_device);
--
2.17.1
next prev parent reply other threads:[~2018-09-02 13:08 UTC|newest]
Thread overview: 92+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-02 13:06 [PATCH AUTOSEL 4.14 01/89] misc: mic: SCIF Fix scif_get_new_port() error handling Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 02/89] ALSA: hda/realtek - Add mute LED quirk for HP Spectre x360 Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 03/89] ethtool: Remove trailing semicolon for static inline Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 04/89] i2c: aspeed: Add an explicit type casting for *get_clk_reg_val Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 05/89] Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 06/89] gpio: tegra: Move driver registration to subsys_init level Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 07/89] powerpc/powernv: Fix concurrency issue with npu->mmio_atsd_usage Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 08/89] selftests/bpf: fix a typo in map in map test Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 09/89] media: davinci: vpif_display: Mix memory leak on probe error path Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 10/89] media: dw2102: Fix memleak on sequence of probes Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 11/89] net: phy: Fix the register offsets in Broadcom iProc mdio mux driver Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 12/89] scsi: qla2xxx: Fix unintended Logout Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 13/89] blk-mq: fix updating tags depth Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 14/89] scsi: target: fix __transport_register_session locking Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 15/89] media: usbtv: use irqsave() in USB's complete callback Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 16/89] md/raid5: fix data corruption of replacements after originals dropped Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 17/89] timers: Clear timer_base::must_forward_clk with timer_base::lock held Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 18/89] media: camss: csid: Configure data type and decode format properly Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 19/89] gpu: ipu-v3: default to id 0 on missing OF alias Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 20/89] misc: ti-st: Fix memory leak in the error path of probe() Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 21/89] uio: potential double frees if __uio_register_device() fails Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 22/89] firmware: vpd: Fix section enabled flag on vpd_section_destroy Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 23/89] Drivers: hv: vmbus: Cleanup synic memory free path Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 24/89] tty: rocket: Fix possible buffer overwrite on register_PCI Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 25/89] f2fs: fix to active page in lru list for read path Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 26/89] ftrace: Add missing check for existing hwlat thread Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 27/89] f2fs: do not set free of current section Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 28/89] f2fs: fix defined but not used build warnings Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 29/89] perf tools: Allow overriding MAX_NR_CPUS at compile time Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 30/89] NFSv4.0 fix client reference leak in callback Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 31/89] perf c2c report: Fix crash for empty browser Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 32/89] fbdev/core: Disable console-lock warnings when fb.lockless_register_fb is set Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 33/89] perf evlist: Fix error out while applying initial delay and LBR Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 34/89] macintosh/via-pmu: Add missing mmio accessors Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 35/89] ath9k: report tx status on EOSP Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 36/89] ath9k_hw: fix channel maximum power level test Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 37/89] ath10k: prevent active scans on potential unusable channels Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 38/89] wlcore: Set rx_status boottime_ns field on rx Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 39/89] rpmsg: core: add support to power domains for devices Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 40/89] MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 41/89] ata: libahci: Allow reconfigure of DEVSLP register Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 42/89] ata: libahci: Correct setting " Sasha Levin
2018-09-02 13:06 ` [PATCH AUTOSEL 4.14 43/89] scsi: 3ware: fix return 0 on the error path of probe Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 44/89] tools/testing/nvdimm: kaddr and pfn can be NULL to ->direct_access() Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 45/89] ath10k: disable bundle mgmt tx completion event support Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 46/89] Bluetooth: hidp: Fix handling of strncpy for hid->name information Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 47/89] x86/mm: Remove in_nmi() warning from vmalloc_fault() Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 48/89] x86/kexec: Allocate 8k PGDs for PTI Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 49/89] ARM: 8783/1: NOMMU: Extend check for VBAR support Sasha Levin
2018-09-10 9:42 ` Vladimir Murzin
2018-09-10 14:12 ` Sasha Levin
2018-09-12 17:31 ` Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 50/89] pinctrl: imx: off by one in imx_pinconf_group_dbg_show() Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 51/89] gpio: ml-ioh: Fix buffer underwrite on probe error path Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 52/89] pinctrl/amd: only handle irq if it is pending and unmasked Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 53/89] net: mvneta: fix mtu change on port without link Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 54/89] f2fs: try grabbing node page lock aggressively in sync scenario Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 55/89] pktcdvd: Fix possible Spectre-v1 for pkt_devs Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 56/89] f2fs: fix to skip GC if type in SSA and SIT is inconsistent Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 57/89] tpm_tis_spi: Pass the SPI IRQ down to the driver Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 58/89] tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 59/89] f2fs: fix to do sanity check with reserved blkaddr of inline inode Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 60/89] MIPS: Octeon: add missing of_node_put() Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 61/89] MIPS: generic: fix " Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 62/89] iio: ad9523: Fix return value for ad952x_store() Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 63/89] net: dcb: For wild-card lookups, use priority -1, not 0 Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 64/89] dm cache: only allow a single io_mode cache feature to be requested Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 65/89] Input: atmel_mxt_ts - only use first T9 instance Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 66/89] iommu/dma: Respect bus DMA limit for IOVAs Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 67/89] media: s5p-mfc: Fix buffer look up in s5p_mfc_handle_frame_{new, copy_time} functions Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 68/89] partitions/aix: append null character to print data from disk Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 69/89] partitions/aix: fix usage of uninitialized lv_info and lvname structures Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 70/89] media: helene: fix xtal frequency setting at power on Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 71/89] f2fs: fix to wait on page writeback before updating page Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 72/89] f2fs: Fix uninitialized return in f2fs_ioc_shutdown() Sasha Levin
2018-09-02 13:07 ` Sasha Levin [this message]
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 74/89] iommu/ipmmu-vmsa: Fix allocation in atomic context Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 75/89] mfd: ti_am335x_tscadc: Fix struct clk memory leak Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 76/89] f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 77/89] ALSA: riptide: Properly endian notations Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 78/89] ALSA: pcm: Fix sparse warning wrt PCM format type Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 79/89] ALSA: wss: " Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 80/89] ALSA: sb: Fix PCM format bit calculation Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 81/89] ALSA: asihpi: Fix PCM format notations Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 82/89] ALSA: ad1816a: Fix sparse warning wrt PCM format type Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 83/89] ALSA: hda: Fix implicit PCM format type conversion Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 84/89] ALSA: au88x0: Fix sparse warning wrt PCM format type Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 85/89] ALSA: sb: " Sasha Levin
2018-09-02 13:07 ` [PATCH AUTOSEL 4.14 86/89] NFSv4.1: Fix a potential layoutget/layoutrecall deadlock Sasha Levin
2018-09-02 13:08 ` [PATCH AUTOSEL 4.14 87/89] MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON Sasha Levin
2018-09-02 13:08 ` [PATCH AUTOSEL 4.14 88/89] RDMA/cma: Do not ignore net namespace for unbound cm_id Sasha Levin
2018-09-02 13:08 ` [PATCH AUTOSEL 4.14 89/89] fuse: Add missed unlock_page() to fuse_readpages_fill() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180902064918.183387-73-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=brad@nextdimension.cc \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=mkrufky@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome