Max Kellermann
da677fe143
[media] dvb-core/en50221: use kref to manage struct dvb_ca_private ...
Don't free the object until the file handle has been closed. Fixes
use-after-free bug which occurs when I disconnect my DVB-S received
while VDR is running.
This is a crash dump of such a use-after-free:
general protection fault: 0000 [#1 ] SMP
CPU: 0 PID: 2541 Comm: CI adapter on d Not tainted 4.7.0-rc1-hosting+ #49
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: ffff880027d7ce00 ti: ffff88003d8f8000 task.ti: ffff88003d8f8000
RIP: 0010:[<ffffffff812f3d1f>] [<ffffffff812f3d1f>] dvb_ca_en50221_io_read_condition.isra.7+0x6f/0x150
RSP: 0018:ffff88003d8fba98 EFLAGS: 00010206
RAX: 0000000059534255 RBX: 000000753d470f90 RCX: ffff88003c74d181
RDX: 00000001bea04ba9 RSI: ffff88003d8fbaf4 RDI: 3a3030a56d763fc0
RBP: ffff88003d8fbae0 R08: ffff88003c74d180 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88003c480e00
R13: 00000000ffffffff R14: 0000000059534255 R15: 0000000000000000
FS: 00007fb4209b4700(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f06445f4078 CR3: 000000003c55b000 CR4: 00000000000006b0
Stack:
ffff88003d8fbaf4 000000003c2170c0 0000000000004000 0000000000000000
ffff88003c480e00 ffff88003d8fbc80 ffff88003c74d180 ffff88003d8fbb8c
0000000000000000 ffff88003d8fbb10 ffffffff812f3e37 ffff88003d8fbb00
Call Trace:
[<ffffffff812f3e37>] dvb_ca_en50221_io_poll+0x37/0xa0
[<ffffffff8113109b>] do_sys_poll+0x2db/0x520
This is a backtrace of the kernel attempting to lock a freed mutex:
#0 0xffffffff81083d40 in rep_nop () at ./arch/x86/include/asm/processor.h:569
#1 cpu_relax () at ./arch/x86/include/asm/processor.h:574
#2 virt_spin_lock (lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:57
#3 native_queued_spin_lock_slowpath (lock=0xffff88003c480e90, val=761492029) at kernel/locking/qspinlock.c:304
#4 0xffffffff810d1a06 in pv_queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/paravirt.h:669
#5 queued_spin_lock_slowpath (val=<optimized out>, lock=<optimized out>) at ./arch/x86/include/asm/qspinlock.h:28
#6 queued_spin_lock (lock=<optimized out>) at include/asm-generic/qspinlock.h:107
#7 __mutex_lock_common (use_ww_ctx=<optimized out>, ww_ctx=<optimized out>, ip=<optimized out>, nest_lock=<optimized out>, subclass=<optimized out>,
state=<optimized out>, lock=<optimized out>) at kernel/locking/mutex.c:526
#8 mutex_lock_interruptible_nested (lock=0xffff88003c480e88, subclass=<optimized out>) at kernel/locking/mutex.c:647
#9 0xffffffff812f49fe in dvb_ca_en50221_io_do_ioctl (file=<optimized out>, cmd=761492029, parg=0x1 <irq_stack_union+1>)
at drivers/media/dvb-core/dvb_ca_en50221.c:1210
#10 0xffffffff812ee660 in dvb_usercopy (file=<optimized out>, cmd=761492029, arg=<optimized out>, func=<optimized out>) at drivers/media/dvb-core/dvbdev.c:883
#11 0xffffffff812f3410 in dvb_ca_en50221_io_ioctl (file=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at drivers/media/dvb-core/dvb_ca_en50221.c:1284
#12 0xffffffff8112eddd in vfs_ioctl (arg=<optimized out>, cmd=<optimized out>, filp=<optimized out>) at fs/ioctl.c:43
#13 do_vfs_ioctl (filp=0xffff88003c480e90, fd=<optimized out>, cmd=<optimized out>, arg=<optimized out>) at fs/ioctl.c:674
#14 0xffffffff8112f30c in SYSC_ioctl (arg=<optimized out>, cmd=<optimized out>, fd=<optimized out>) at fs/ioctl.c:689
#15 SyS_ioctl (fd=6, cmd=2148298626, arg=140734533693696) at fs/ioctl.c:680
#16 0xffffffff8103feb2 in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:207
Signed-off-by: Max Kellermann <max@duempel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2016-07-13 15:45:29 -03:00
2016-07-01 15:31:48 -07:00
2016-05-05 19:00:40 +01:00
2016-06-28 12:11:31 -07:00
2016-05-31 11:52:59 -07:00
2016-06-18 06:04:01 -10:00
2016-05-24 11:00:20 -07:00
2016-06-24 17:23:52 -07:00
2016-05-13 16:54:59 +02:00
2016-05-19 10:02:26 -07:00
2016-06-13 08:56:28 -05:00
2016-06-20 17:01:45 -07:00
2016-05-19 11:27:09 -07:00
2016-06-28 08:48:33 -04:00
2016-06-28 03:29:29 +02:00
2016-05-18 02:48:37 +02:00
2016-06-13 17:43:05 +08:00
2016-05-20 22:02:55 -07:00
2016-06-23 23:15:12 +02:00
2016-06-07 12:44:23 +05:30
2016-05-31 22:17:05 +05:30
2016-06-03 17:28:21 +02:00
2016-06-15 17:17:22 +09:00
2016-05-04 14:16:49 -04:00
2016-06-03 09:57:36 +02:00
2016-06-29 10:05:44 -07:00
2016-07-13 13:43:48 -03:00
2016-06-28 13:24:14 +02:00
2016-05-09 22:45:18 +02:00
2016-05-01 09:23:14 -07:00
2016-06-23 06:24:23 -07:00
2016-05-20 17:58:30 -07:00
2016-06-16 00:13:06 -07:00
2016-06-09 22:38:16 +02:00
2016-06-26 17:39:26 +01:00
2016-06-23 12:22:33 -04:00
2016-07-08 18:14:03 -03:00
2016-06-27 13:24:46 +02:00
2016-04-30 09:26:55 -07:00
2016-06-14 11:41:57 +02:00
2016-05-20 20:57:27 -07:00
2016-06-08 11:47:06 +02:00
2016-05-06 12:51:10 -06:00
2016-05-01 18:33:04 +10:00
2016-05-08 22:44:46 +05:30
2016-06-13 18:49:30 -07:00
2016-05-27 14:28:09 -07:00
2016-07-13 15:45:29 -03:00
2016-06-16 11:43:48 +03:00
2016-05-23 17:04:14 -07:00
2016-05-18 16:38:59 -07:00
2016-06-30 07:44:23 +01:00
2016-06-10 22:14:24 -07:00
2016-06-02 10:40:20 +02:00
2016-06-23 00:29:32 +02:00
2016-06-29 08:12:45 -04:00
2016-05-10 00:01:47 +02:00
2016-06-23 17:50:39 -07:00
2016-06-09 14:28:28 -06:00
2016-05-27 15:26:11 -07:00
2016-07-08 18:14:03 -03:00
2016-04-30 13:56:46 -07:00
2016-06-20 13:24:20 -05:00
2016-05-01 18:32:32 +10:00
2016-06-15 09:51:35 +01:00
2016-07-01 15:17:16 -07:00
2016-06-23 11:05:04 +02:00
2016-06-08 13:21:37 -07:00
2016-05-20 21:26:15 -07:00
2016-06-16 15:54:11 +02:00
2016-05-16 19:17:22 -07:00
2016-05-29 22:32:27 -07:00
2016-06-14 10:51:45 +02:00
2016-05-05 17:38:53 -07:00
2016-07-01 18:06:48 +02:00
2016-05-12 15:50:19 -07:00
2016-05-06 11:08:58 -07:00
2016-05-21 17:07:17 +02:00
2016-05-26 19:34:26 -07:00
2016-05-20 18:33:37 -07:00
2016-06-18 11:59:01 -07:00
2016-05-19 15:20:24 +02:00
2016-06-30 13:17:29 +01:00
2016-04-30 14:15:56 -07:00
2016-07-13 15:40:43 -03:00
2016-05-28 12:04:17 -07:00
2016-06-12 06:30:39 -07:00
2016-05-02 12:09:22 -05:00
2016-06-26 11:39:00 -07:00
2016-05-01 14:11:12 -07:00
2016-07-08 18:14:03 -03:00
2016-05-31 21:25:52 -06:00
2016-05-10 01:19:26 -07:00
2016-05-31 08:20:43 +03:00
2016-05-22 19:44:13 +03:00
2016-05-01 14:00:00 -07:00
2016-05-01 14:37:49 -07:00
2016-06-17 20:21:12 -07:00
2016-06-24 10:53:03 +01:00
2016-05-23 11:18:01 -07:00
2016-05-20 22:02:53 -07:00
da677fe143