summaryrefslogtreecommitdiff
path: root/drivers/media/dvb-frontends/lgdt330x.h
diff options
context:
space:
mode:
authorMatthias Schwarzott <zzam@gentoo.org>2017-08-02 19:46:00 +0300
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2017-08-27 13:33:47 +0300
commite59eb4adf0d79fe7692c08c07445ec9efc8ddc1c (patch)
treec770a4bdb12f205cc26bb61a1bf7ad88abe4ccf9 /drivers/media/dvb-frontends/lgdt330x.h
parent412b16d623cf4fd794713f314db5aad10c46ad87 (diff)
downloadlinux-e59eb4adf0d79fe7692c08c07445ec9efc8ddc1c.tar.xz
media: cx231xx: fix use-after-free when unregistering the i2c_client for the dvb demod
Calling i2c_unregister_device for a demod driver destroys the frontend object. Later it is accessed by calling dvb_unregister_frontend and dvb_frontend_detach. In some cases this leads to a general protection fault with this callstack: dvb_unregister_frontend+0x25/0x50 [dvb_core] dvb_fini+0xdb/0x160 [cx231xx_dvb] cx231xx_unregister_extension+0x3d/0xb0 [cx231xx] cx231xx_dvb_unregister+0x10/0x809 [cx231xx_dvb] SyS_delete_module+0x18a/0x240 ? exit_to_usermode_loop+0x7b/0x80 entry_SYSCALL_64_fastpath+0x17/0x98 Signed-off-by: Matthias Schwarzott <zzam@gentoo.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/dvb-frontends/lgdt330x.h')
0 files changed, 0 insertions, 0 deletions