Received: by 2002:a25:5b86:0:0:0:0:0 with SMTP id p128csp2081149ybb; Fri, 29 Mar 2019 18:33:07 -0700 (PDT) X-Google-Smtp-Source: APXvYqwKcko5Rf+5rpvW2UzegdqRU/xlV/WdALymUcTP86+QRMp4RIxc88M4ayic0a+W4iTd49hE X-Received: by 2002:a63:fb45:: with SMTP id w5mr48961556pgj.118.1553909587821; Fri, 29 Mar 2019 18:33:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553909587; cv=none; d=google.com; s=arc-20160816; b=NQGeWLRigIn6km5CMttWSEQhGC66iCk60XjQBMnJmLxOhvrqDUnfHL/Jvp+B7vL6ag eNfbHBf2KLU1d0T7c2bCfV3D1bImQhbuHwpwN9oZk34zHeEbUKmC225LHgNBB41jbZej AFKwzfeLGdrhkL7awZaJnJ2Fio+SPSxE1WiMuaIzV14t+bU6CalSWWninC8QdHXSROwB Awg2EdLG2RzuQMLki7ez2oeSgy2pUAb+g4f2BY1wuLM2fYRzbd4+y2TmO9Jq57m3Mkb5 qgIAsqSDXA4wvkpXxjR5AMsdHrksZhb2ND2UafOlYNdgifnE9Yr08YxaXEJ1ks4cGrPr 7uCA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=2WJQX9pQBAtkMierm7g5jAnpX7PY+JMVs4HIjdL3yrM=; b=s2GokZREYZq5mCMSm9qPRtL5jxkd18UFVb3XlFh6VpMDT88FBBvw9szdJ/NR+iLrdp PXiGwWtc+zCDG4HWq1rSBf/MSsqZfmBBVsHtadbk0+23yd1cW1JT3CmS796KTIuE913w LEmCfiryL1QtSWcARYl8hRy+WKbJus87UWxVuWzg1WfrIYUOrI/TFRas9Lfd4idiKxpq 2Bs687LkHZMWgbLBZJs1KGl1nxt5AfaNcuX/53M+H569LFzlSzEjnzHag+lBFRepRBad 5PBBtXYtJq01hzjMDzgfbEBzwF0Zz4cXgCsFUbLgVKbZhEOWQDxDcKC838cRvTYPIdfP iiYA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=sftbXXcG; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d16si3150724pgh.440.2019.03.29.18.32.52; Fri, 29 Mar 2019 18:33:07 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=sftbXXcG; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731713AbfC3Bah (ORCPT + 99 others); Fri, 29 Mar 2019 21:30:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:37878 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731703AbfC3Baf (ORCPT ); Fri, 29 Mar 2019 21:30:35 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 58B68218A6; Sat, 30 Mar 2019 01:30:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553909434; bh=Jl0KP1gBPY46F7Qi5eYWw3hmLXbME6CJbG8G1cX4GG4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sftbXXcGlpP3jlOtJljwvgWZyTjNEbzMtcKUBH3qcfJQajRO/K+EER63OQ/+7Yl49 R/g3FSom3uNWUkVWSZnvt51W6HqIE1AV6xHpfJ+DEhHjcctIIAu/AW2lXtErWafYcn UxxqNRN7xDjF9uBKYODj/o0dj0Ao8DmTKlKrBrrc= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Brad Love , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin , linux-media@vger.kernel.org Subject: [PATCH AUTOSEL 4.14 09/37] media: au0828: cannot kfree dev before usb disconnect Date: Fri, 29 Mar 2019 21:29:52 -0400 Message-Id: <20190330013020.379-9-sashal@kernel.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20190330013020.379-1-sashal@kernel.org> References: <20190330013020.379-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Brad Love [ Upstream commit 4add7104919f9e94e0db03e234caeadbfcc02ea9 ] If au0828_analog_register fails, the dev is kfree'd and then flow jumps to done, which can call au0828_usb_disconnect. Since all USB error codes are negative, au0828_usb_disconnect will be called. The problem is au0828_usb_disconnect uses dev, if dev is NULL then there is immediate oops encountered. [ 7.454307] au0828: au0828_usb_probe() au0282_dev_register failed to register on V4L2 [ 7.454323] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 [ 7.454421] PGD 0 P4D 0 [ 7.454457] Oops: 0002 [#1] SMP PTI [ 7.454500] CPU: 1 PID: 262 Comm: systemd-udevd Tainted: P O 4.18.3 #1 [ 7.454584] Hardware name: Google Panther/Panther, BIOS MattDevo 04/27/2015 [ 7.454670] RIP: 0010:_raw_spin_lock_irqsave+0x2c/0x50 [ 7.454725] Code: 44 00 00 55 48 89 e5 41 54 53 48 89 fb 9c 58 0f 1f 44 00 00 49 89 c4 fa 66 0f 1f 44 00 00 e8 db 23 1b ff 31 c0 ba 01 00 00 00 0f b1 13 85 c0 75 08 4c 89 e0 5b 41 5c 5d c3 89 c6 48 89 df e8 [ 7.455004] RSP: 0018:ffff9130f53ef988 EFLAGS: 00010046 [ 7.455063] RAX: 0000000000000000 RBX: 0000000000000050 RCX: 0000000000000000 [ 7.455139] RDX: 0000000000000001 RSI: 0000000000000003 RDI: 0000000000000050 [ 7.455216] RBP: ffff9130f53ef998 R08: 0000000000000018 R09: 0000000000000090 [ 7.455292] R10: ffffed4cc53cb000 R11: ffffed4cc53cb108 R12: 0000000000000082 [ 7.455369] R13: ffff9130cf2c6188 R14: 0000000000000000 R15: 0000000000000018 [ 7.455447] FS: 00007f2ff8514cc0(0000) GS:ffff9130fcb00000(0000) knlGS:0000000000000000 [ 7.455535] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7.455597] CR2: 0000000000000050 CR3: 00000001753f0002 CR4: 00000000000606a0 [ 7.455675] Call Trace: [ 7.455713] __wake_up_common_lock+0x65/0xc0 [ 7.455764] __wake_up+0x13/0x20 [ 7.455808] ir_lirc_unregister+0x57/0xe0 [rc_core] [ 7.455865] rc_unregister_device+0xa0/0xc0 [rc_core] [ 7.455935] au0828_rc_unregister+0x25/0x40 [au0828] [ 7.455999] au0828_usb_disconnect+0x33/0x80 [au0828] [ 7.456064] au0828_usb_probe.cold.16+0x8d/0x2aa [au0828] [ 7.456130] usb_probe_interface+0xf1/0x300 [ 7.456184] driver_probe_device+0x2e3/0x460 [ 7.456235] __driver_attach+0xe4/0x110 [ 7.456282] ? driver_probe_device+0x460/0x460 [ 7.456335] bus_for_each_dev+0x74/0xb0 [ 7.456385] ? kmem_cache_alloc_trace+0x15d/0x1d0 [ 7.456441] driver_attach+0x1e/0x20 [ 7.456485] bus_add_driver+0x159/0x230 [ 7.456532] driver_register+0x70/0xc0 [ 7.456578] usb_register_driver+0x7f/0x140 [ 7.456626] ? 0xffffffffc0474000 [ 7.456674] au0828_init+0xbc/0x1000 [au0828] [ 7.456725] do_one_initcall+0x4a/0x1c9 [ 7.456771] ? _cond_resched+0x19/0x30 [ 7.456817] ? kmem_cache_alloc_trace+0x15d/0x1d0 [ 7.456873] do_init_module+0x60/0x210 [ 7.456918] load_module+0x221b/0x2710 [ 7.456966] ? vfs_read+0xf5/0x120 [ 7.457010] __do_sys_finit_module+0xbd/0x120 [ 7.457061] ? __do_sys_finit_module+0xbd/0x120 [ 7.457115] __x64_sys_finit_module+0x1a/0x20 [ 7.457166] do_syscall_64+0x5b/0x110 [ 7.457210] entry_SYSCALL_64_after_hwframe+0x49/0xbe Signed-off-by: Brad Love Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/usb/au0828/au0828-core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c index cd363a2100d4..257ae0d8cfe2 100644 --- a/drivers/media/usb/au0828/au0828-core.c +++ b/drivers/media/usb/au0828/au0828-core.c @@ -629,7 +629,6 @@ static int au0828_usb_probe(struct usb_interface *interface, pr_err("%s() au0282_dev_register failed to register on V4L2\n", __func__); mutex_unlock(&dev->lock); - kfree(dev); goto done; } -- 2.19.1