From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Brad Love <brad@nextdimension.cc>,
Michael Ira Krufky <mkrufky@gmail.com>,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 4.4 33/47] media: em28xx: Fix DualHD disconnect oops
Date: Sun, 2 Sep 2018 13:16:19 +0000 [thread overview]
Message-ID: <20180902131533.184092-33-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20180902131533.184092-1-alexander.levin@microsoft.com>
From: Brad Love <brad@nextdimension.cc>
[ Upstream commit 20cdcaf903298d54b834daedf65a2ddef70cae0a ]
During the duplication of em28xx state for the second tuner pair
a pointer to alt_max_pkt_size_isoc is copied. During tear down
the second tuner is destroyed first and kfrees alt_max_pkt_size_isoc,
then the first tuner is destroyed and kfrees it again. The property
should only be kfree'd if the tuner is PRIMARY_TS.
[ 354.888560] ------------[ cut here ]------------
[ 354.888562] kernel BUG at mm/slub.c:296!
[ 354.888574] invalid opcode: 0000 [#1] SMP NOPTI
[ 354.888869] CPU: 1 PID: 19 Comm: kworker/1:0 Not tainted 4.18.0-rc1+ #20
[ 354.889140] Hardware name: MSI MS-7A39/B350M GAMING PRO (MS-7A39), BIOS 2.G0 04/27/2018
[ 354.889408] Workqueue: usb_hub_wq hub_event
[ 354.889679] RIP: 0010:__slab_free+0x217/0x370
[ 354.889942] Code: bb c0 e8 07 41 38 c7 72 39 48 83 c4 70 5b 41 5a 41 5c 41 5d 41 5e 41 5f 5d 49 8d 62 f8 c3 f3 90 49 8b 04 24 a8 01 75 f6 eb 82 <0f> 0b 44 89 45 80 48 89 4d 88 e8 aa fa ff ff 85 c0 74 cc e9 b7 fe
[ 354.890598] RSP: 0018:ffffb84c41a4fad0 EFLAGS: 00010246
[ 354.890934] RAX: ffff948646e85150 RBX: ffff948646e85150 RCX: ffff948646e85150
[ 354.891280] RDX: 00000000820001d9 RSI: fffffa8fd01ba140 RDI: ffff94865e807c00
[ 354.891649] RBP: ffffb84c41a4fb70 R08: 0000000000000001 R09: ffffffffc059ce21
[ 354.892025] R10: ffff948646e85150 R11: 0000000000000001 R12: fffffa8fd01ba140
[ 354.892403] R13: ffff948646e85150 R14: ffff94865e807c00 R15: ffff94864c92e0a0
[ 354.892780] FS: 0000000000000000(0000) GS:ffff94865ec40000(0000) knlGS:0000000000000000
[ 354.893150] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 354.893530] CR2: 00007f4e476da950 CR3: 000000040112c000 CR4: 00000000003406e0
[ 354.893917] Call Trace:
[ 354.894315] ? __dev_printk+0x3c/0x80
[ 354.894695] ? _dev_info+0x64/0x80
[ 354.895082] ? em28xx_free_device+0x41/0x50 [em28xx]
[ 354.895464] kfree+0x17a/0x190
[ 354.895852] ? kfree+0x17a/0x190
[ 354.896310] em28xx_free_device+0x41/0x50 [em28xx]
[ 354.896698] em28xx_usb_disconnect+0xfa/0x110 [em28xx]
[ 354.897083] usb_unbind_interface+0x7a/0x270
[ 354.897475] device_release_driver_internal+0x17c/0x250
[ 354.897864] device_release_driver+0x12/0x20
[ 354.898252] bus_remove_device+0xec/0x160
[ 354.898639] device_del+0x13d/0x320
[ 354.899018] ? usb_remove_ep_devs+0x1f/0x30
[ 354.899392] usb_disable_device+0x9e/0x270
[ 354.899772] usb_disconnect+0x92/0x2a0
[ 354.900149] hub_event+0x98e/0x1650
[ 354.900519] ? sched_clock_cpu+0x11/0xa0
[ 354.900890] process_one_work+0x167/0x3f0
[ 354.901251] worker_thread+0x4d/0x460
[ 354.901610] kthread+0x105/0x140
[ 354.901964] ? rescuer_thread+0x360/0x360
[ 354.902318] ? kthread_associate_blkcg+0xa0/0xa0
[ 354.902672] ret_from_fork+0x22/0x40
[ 354.903024] Modules linked in: rc_hauppauge em28xx_rc rc_core si2157 lgdt3306a i2c_mux em28xx_dvb dvb_core videobuf2_vmalloc videobuf2_memops videobuf2_common snd_hda_codec_hdmi nls_iso8859_1 edac_mce_amd kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi aesni_intel snd_seq_midi_event aes_x86_64 snd_rawmidi crypto_simd em28xx cryptd glue_helper asix tveeprom usbnet snd_seq v4l2_common mii videodev snd_seq_device media input_leds snd_timer joydev ccp k10temp wmi_bmof snd soundcore mac_hid sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables vfio_pci vfio_virqfd irqbypass vfio_iommu_type1 vfio nouveau mxm_wmi video i2c_algo_bit ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops i2c_piix4 drm ahci libahci
[ 354.905129] wmi gpio_amdpt gpio_generic hid_generic usbhid hid
[ 354.908140] ---[ end trace c230d02716298c34 ]---
[ 354.908145] RIP: 0010:__slab_free+0x217/0x370
[ 354.908147] Code: bb c0 e8 07 41 38 c7 72 39 48 83 c4 70 5b 41 5a 41 5c 41 5d 41 5e 41 5f 5d 49 8d 62 f8 c3 f3 90 49 8b 04 24 a8 01 75 f6 eb 82 <0f> 0b 44 89 45 80 48 89 4d 88 e8 aa fa ff ff 85 c0 74 cc e9 b7 fe
[ 354.908183] RSP: 0018:ffffb84c41a4fad0 EFLAGS: 00010246
[ 354.908186] RAX: ffff948646e85150 RBX: ffff948646e85150 RCX: ffff948646e85150
[ 354.908189] RDX: 00000000820001d9 RSI: fffffa8fd01ba140 RDI: ffff94865e807c00
[ 354.908191] RBP: ffffb84c41a4fb70 R08: 0000000000000001 R09: ffffffffc059ce21
[ 354.908193] R10: ffff948646e85150 R11: 0000000000000001 R12: fffffa8fd01ba140
[ 354.908195] R13: ffff948646e85150 R14: ffff94865e807c00 R15: ffff94864c92e0a0
[ 354.908198] FS: 0000000000000000(0000) GS:ffff94865ec40000(0000) knlGS:0000000000000000
[ 354.908201] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 354.908203] CR2: 00007f4e476da950 CR3: 000000016b20a000 CR4: 00000000003406e0
Signed-off-by: Brad Love <brad@nextdimension.cc>
Signed-off-by: Michael Ira Krufky <mkrufky@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
drivers/media/usb/em28xx/em28xx-cards.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 394004607059..c41e93b7828e 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3045,7 +3045,9 @@ void em28xx_free_device(struct kref *ref)
if (!dev->disconnected)
em28xx_release_resources(dev);
- kfree(dev->alt_max_pkt_size_isoc);
+ if (dev->ts == PRIMARY_TS)
+ kfree(dev->alt_max_pkt_size_isoc);
+
kfree(dev);
}
EXPORT_SYMBOL_GPL(em28xx_free_device);
--
2.17.1
next prev parent reply other threads:[~2018-09-02 13:19 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-02 13:15 [PATCH AUTOSEL 4.4 01/47] misc: mic: SCIF Fix scif_get_new_port() error handling Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 02/47] ethtool: Remove trailing semicolon for static inline Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 03/47] Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 04/47] gpio: tegra: Move driver registration to subsys_init level Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 05/47] scsi: target: fix __transport_register_session locking Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 06/47] media: usbtv: use irqsave() in USB's complete callback Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 07/47] md/raid5: fix data corruption of replacements after originals dropped Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 08/47] misc: ti-st: Fix memory leak in the error path of probe() Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 09/47] uio: potential double frees if __uio_register_device() fails Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 10/47] tty: rocket: Fix possible buffer overwrite on register_PCI Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 11/47] f2fs: do not set free of current section Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 12/47] perf tools: Allow overriding MAX_NR_CPUS at compile time Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 13/47] NFSv4.0 fix client reference leak in callback Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 14/47] macintosh/via-pmu: Add missing mmio accessors Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 15/47] ath10k: prevent active scans on potential unusable channels Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 16/47] wlcore: Set rx_status boottime_ns field on rx Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 17/47] MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 18/47] ata: libahci: Correct setting of DEVSLP register Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 19/47] scsi: 3ware: fix return 0 on the error path of probe Sasha Levin
2018-09-02 13:15 ` [PATCH AUTOSEL 4.4 20/47] ath10k: disable bundle mgmt tx completion event support Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 21/47] Bluetooth: hidp: Fix handling of strncpy for hid->name information Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 22/47] x86/mm: Remove in_nmi() warning from vmalloc_fault() Sasha Levin
2018-09-03 13:42 ` Pavel Machek
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 24/47] gpio: ml-ioh: Fix buffer underwrite on probe error path Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 23/47] x86/kexec: Allocate 8k PGDs for PTI Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 25/47] net: mvneta: fix mtu change on port without link Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 26/47] tpm/tpm_i2c_infineon: switch to i2c_lock_bus(..., I2C_LOCK_SEGMENT) Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 27/47] MIPS: Octeon: add missing of_node_put() Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 28/47] iio: ad9523: Fix return value for ad952x_store() Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 29/47] net: dcb: For wild-card lookups, use priority -1, not 0 Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 30/47] Input: atmel_mxt_ts - only use first T9 instance Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 31/47] partitions/aix: append null character to print data from disk Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 32/47] partitions/aix: fix usage of uninitialized lv_info and lvname structures Sasha Levin
2018-09-02 13:16 ` Sasha Levin [this message]
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 34/47] iommu/ipmmu-vmsa: Fix allocation in atomic context Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 35/47] mfd: ti_am335x_tscadc: Fix struct clk memory leak Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 36/47] f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 37/47] ALSA: riptide: Properly endian notations Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 38/47] ALSA: wss: Fix sparse warning wrt PCM format type Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 39/47] ALSA: sb: Fix PCM format bit calculation Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 40/47] ALSA: asihpi: Fix PCM format notations Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 41/47] ALSA: ad1816a: Fix sparse warning wrt PCM format type Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 42/47] ALSA: hda: Fix implicit PCM format type conversion Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 43/47] ALSA: au88x0: Fix sparse warning wrt PCM format type Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 44/47] ALSA: sb: " Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 45/47] MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 46/47] RDMA/cma: Do not ignore net namespace for unbound cm_id Sasha Levin
2018-09-02 13:16 ` [PATCH AUTOSEL 4.4 47/47] fuse: Add missed unlock_page() to fuse_readpages_fill() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180902131533.184092-33-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=brad@nextdimension.cc \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=mkrufky@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome