From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Mauro Carvalho Chehab" <mchehab@osg.samsung.com>
Subject: [PATCH 3.2 45/67] [media] saa7134-alsa: Only frees registered sound cards
Date: Tue, 23 Feb 2016 21:42:03 +0000 [thread overview]
Message-ID: <lsq.1456263723.794917497@decadent.org.uk> (raw)
In-Reply-To: <lsq.1456263722.390955919@decadent.org.uk>
3.2.78-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
commit ac75fe5d8fe4a0bf063be18fb29684405279e79e upstream.
That prevents this bug:
[ 2382.269496] BUG: unable to handle kernel NULL pointer dereference at 0000000000000540
[ 2382.270013] IP: [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
[ 2382.270013] PGD 0
[ 2382.270013] Oops: 0002 [#1] SMP
[ 2382.270013] Modules linked in: saa7134_alsa(-) tda1004x saa7134_dvb videobuf2_dvb dvb_core tda827x tda8290 tuner saa7134 tveeprom videobuf2_dma_sg videobuf2_memops videobuf2_v4l2 videobuf2_core v4l2_common videodev media auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc tun bridge stp llc ebtables ip6table_filter ip6_tables nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack it87 hwmon_vid snd_hda_codec_idt snd_hda_codec_generic iTCO_wdt iTCO_vendor_support snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq pcspkr i2c_i801 snd_seq_device snd_pcm snd_timer lpc_ich snd mfd_core soundcore binfmt_misc i915 video i2c_algo_bit drm_kms_helper drm r8169 ata_generic serio_raw pata_acpi mii i2c_core [last unloaded: videobuf2_memops]
[ 2382.270013] CPU: 0 PID: 4899 Comm: rmmod Not tainted 4.5.0-rc1+ #4
[ 2382.270013] Hardware name: PCCHIPS P17G/P17G, BIOS 080012 05/14/2008
[ 2382.270013] task: ffff880039c38000 ti: ffff88003c764000 task.ti: ffff88003c764000
[ 2382.270013] RIP: 0010:[<ffffffffa01fe616>] [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
[ 2382.270013] RSP: 0018:ffff88003c767ea0 EFLAGS: 00010286
[ 2382.270013] RAX: ffff88003c767eb8 RBX: 0000000000000000 RCX: 0000000000006260
[ 2382.270013] RDX: ffffffffa020a060 RSI: ffffffffa0206de1 RDI: ffff88003c767eb0
[ 2382.270013] RBP: ffff88003c767ed8 R08: 0000000000019960 R09: ffffffff811a5412
[ 2382.270013] R10: ffffea0000d7c200 R11: 0000000000000000 R12: ffff88003c767ea8
[ 2382.270013] R13: 00007ffe760617f7 R14: 0000000000000000 R15: 0000557625d7f1e0
[ 2382.270013] FS: 00007f80bb1c0700(0000) GS:ffff88003f400000(0000) knlGS:0000000000000000
[ 2382.270013] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2382.270013] CR2: 0000000000000540 CR3: 000000003c00f000 CR4: 00000000000006f0
[ 2382.270013] Stack:
[ 2382.270013] 000000003c767ed8 ffffffff00000000 ffff880000000000 ffff88003c767eb8
[ 2382.270013] ffff88003c767eb8 ffffffffa049a890 00007ffe76060060 ffff88003c767ef0
[ 2382.270013] ffffffffa049889d ffffffffa049a500 ffff88003c767f48 ffffffff8111079c
[ 2382.270013] Call Trace:
[ 2382.270013] [<ffffffffa049889d>] saa7134_alsa_exit+0x1d/0x780 [saa7134_alsa]
[ 2382.270013] [<ffffffff8111079c>] SyS_delete_module+0x19c/0x1f0
[ 2382.270013] [<ffffffff8170fc2e>] entry_SYSCALL_64_fastpath+0x12/0x71
[ 2382.270013] Code: 20 a0 48 c7 c6 e1 6d 20 a0 48 89 e5 41 54 53 4c 8d 65 d0 48 89 fb 48 83 ec 28 c7 45 d0 00 00 00 00 49 8d 7c 24 08 e8 7a 55 ed e0 <4c> 89 a3 40 05 00 00 48 89 df e8 eb fd ff ff 85 c0 75 1a 48 8d
[ 2382.270013] RIP [<ffffffffa01fe616>] snd_card_free+0x36/0x70 [snd]
[ 2382.270013] RSP <ffff88003c767ea0>
[ 2382.270013] CR2: 0000000000000540
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/video/saa7134/saa7134-alsa.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -1145,6 +1145,8 @@ static int alsa_device_init(struct saa71
static int alsa_device_exit(struct saa7134_dev *dev)
{
+ if (!snd_saa7134_cards[dev->nr])
+ return 1;
snd_card_free(snd_saa7134_cards[dev->nr]);
snd_saa7134_cards[dev->nr] = NULL;
@@ -1194,7 +1196,8 @@ static void saa7134_alsa_exit(void)
int idx;
for (idx = 0; idx < SNDRV_CARDS; idx++) {
- snd_card_free(snd_saa7134_cards[idx]);
+ if (snd_saa7134_cards[idx])
+ snd_card_free(snd_saa7134_cards[idx]);
}
saa7134_dmasound_init = NULL;
next prev parent reply other threads:[~2016-02-23 22:03 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-23 21:42 [PATCH 3.2 00/67] 3.2.78-rc1 review Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 12/67] USB: visor: fix null-deref at probe Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 17/67] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 56/67] ALSA: timer: Fix race between stop and interrupt Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 36/67] libata: fix sff host state machine locking while polling Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 07/67] cdc-acm:exclude Samsung phone 04e8:685d Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 32/67] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 28/67] x86/mm/pat: Avoid truncation when converting cpa->numpages to address Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 24/67] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 27/67] drm/vmwgfx: respect 'nomodeset' Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 46/67] scsi_dh_rdac: always retry MODE SELECT on command lock violation Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 22/67] perf annotate browser: Fix behaviour of Shift-Tab with nothing focussed Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 41/67] usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 49/67] crypto: user - lock crypto_alg_list on alg dump Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 65/67] iw_cxgb3: Fix incorrectly returning error on success Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 37/67] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 21/67] rfkill: fix rfkill_fop_read wait_event usage Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 67/67] sched: fix __sched_setscheduler() vs load balancing race Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 59/67] ARM: 8519/1: ICST: try other dividends than 1 Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 19/67] libata: disable forced PORTS_IMPL for >= AHCI 1.3 Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 39/67] ALSA: seq: Fix lockdep warnings due to double mutex locks Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 60/67] btrfs: properly set the termination value of ctx->pos in readdir Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 58/67] ahci: Intel DNV device IDs SATA Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 23/67] SCSI: fix crashes in sd and sr runtime PM Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 57/67] ALSA: timer: Fix race at concurrent reads Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 33/67] ALSA: pcm: Fix potential deadlock in OSS emulation Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 64/67] pipe: limit the per-user amount of pages allocated in pipes Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 42/67] xhci: Fix list corruption in urb dequeue at host removal Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 38/67] ALSA: rawmidi: Fix race at copying & updating the position Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 08/67] af_unix: fix struct pid memory leak Ben Hutchings
2016-02-23 22:07 ` Rainer Weikusat
2016-02-24 21:24 ` Ben Hutchings
2016-02-25 7:26 ` Willy Tarreau
2016-02-23 21:42 ` Ben Hutchings [this message]
2016-02-23 21:42 ` [PATCH 3.2 48/67] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 09/67] pptp: fix illegal memory access caused by multiple bind()s Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 31/67] ALSA: seq: Fix race at closing in virmidi driver Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 10/67] sctp: allow setting SCTP_SACK_IMMEDIATELY by the application Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 51/67] klist: fix starting point removed bug in klist iterators Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 54/67] ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz() Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 40/67] Revert "xhci: don't finish a TD if we get a short-transfer event mid TD" Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 18/67] PCI/AER: Flush workqueue on device remove to avoid use-after-free Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 13/67] USB: serial: visor: fix crash on detecting device without write_urbs Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 20/67] virtio_pci: fix use after free on release Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 04/67] posix-timers: Handle relative timers with CONFIG_TIME_LOW_RES proper Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 26/67] ALSA: dummy: Disable switching timer backend via sysfs Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 47/67] mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 50/67] crypto: algif_skcipher - Do not dereference ctx without socket lock Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 29/67] crypto: algif_hash - wait for crypto_ahash_init() to complete Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 44/67] ALSA: timer: Fix leftover link at closing Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 61/67] ALSA: usb-audio: avoid freeing umidi object twice Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 25/67] crypto: shash - Fix has_key setting Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 03/67] timerfd: Handle relative timers with CONFIG_TIME_LOW_RES proper Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 35/67] ALSA: timer: Fix link corruption due to double start or stop Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 11/67] USB: cp210x: add ID for IAI USB to RS485 adaptor Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 15/67] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 34/67] ALSA: seq: Fix yet another races among ALSA timer accesses Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 43/67] [media] tda1004x: only update the frontend properties if locked Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 30/67] intel_scu_ipcutil: underflow in scu_reg_access() Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 62/67] unix: properly account for FDs passed over unix sockets Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 05/67] itimers: Handle relative timers with CONFIG_TIME_LOW_RES proper Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 66/67] pipe: Fix buffer offset after partially failed read Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 06/67] usb: cdc-acm: send zero packet for intel 7260 modem Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 63/67] unix: correctly track in-flight fds in sending process user_struct Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 53/67] ALSA: timer: Fix wrong instance passed to slave callbacks Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 01/67] KVM: vmx: fix MPX detection Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 16/67] ALSA: seq: Degrade the error message for too many opens Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 02/67] hrtimer: Handle remaining time proper for TIME_LOW_RES Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 55/67] sctp: translate network order to host order when users get a hmacid Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 14/67] USB: serial: option: Adding support for Telit LE922 Ben Hutchings
2016-02-23 21:42 ` [PATCH 3.2 52/67] ALSA: dummy: Implement timer backend switching more safely Ben Hutchings
2016-02-24 0:48 ` [PATCH 3.2 00/67] 3.2.78-rc1 review Ben Hutchings
2016-02-24 2:48 ` Guenter Roeck
2016-02-24 14:41 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1456263723.794917497@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@osg.samsung.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®