Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 08 Nov 2017 10:03:00 -0600
Message-ID: <20171108100301.Horde.pDKmT_QqqGyUbLr9ES3Gy9m@gator4166.hostgator.com>
From:   "Gustavo A. R. Silva" <garsilva@embeddedor.com>
To:     Andrey Konovalov <andreyknvl@google.com>
Cc:     Mauro Carvalho Chehab <mchehab@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Dmitry Vyukov <dvyukov@google.com>,
        Kostya Serebryany <kcc@google.com>,
        syzkaller <syzkaller@googlegroups.com>
Subject: Re: usb/media/em28xx: use-after-free in em28xx_dvb_fini
References: <CAAeHK+xNemb9-+pqifrXd5qsnEvbS8h+cgAgy0FhzL1A7FRfJA@mail.gmail.com>
 <20171107211850.GA17663@embeddedor.com>
 <CAAeHK+wtAhx_i3N4ONkNiqU_k=Pgk9p4dxAV9LGs4d=CPxLZcQ@mail.gmail.com>
In-Reply-To: <CAAeHK+wtAhx_i3N4ONkNiqU_k=Pgk9p4dxAV9LGs4d=CPxLZcQ@mail.gmail.com>
User-Agent: Horde Application Framework 5
Content-Type: text/plain; charset=utf-8; format=flowed; DelSp=Yes
MIME-Version: 1.0
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


Quoting Andrey Konovalov <andreyknvl@google.com>:

> On Tue, Nov 7, 2017 at 10:18 PM, Gustavo A. R. Silva
> <garsilva@embeddedor.com> wrote:
>> Hi Andrey,
>>
>> Could you please try this patch?
>>
>> Thank you
>>
>> Gustavo A. R. Silva
>
> Hi Gustavo,
>
> Still see the crash with your patch.
>
> Thanks!
>

Thank you, Andrey. I will look into this further.

--
Gustavo A. R. Silva

>>
>> ---
>>  drivers/media/usb/em28xx/em28xx-dvb.c | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c  
>> b/drivers/media/usb/em28xx/em28xx-dvb.c
>> index 4a7db62..fc3fb92 100644
>> --- a/drivers/media/usb/em28xx/em28xx-dvb.c
>> +++ b/drivers/media/usb/em28xx/em28xx-dvb.c
>> @@ -2073,6 +2073,9 @@ static int em28xx_dvb_fini(struct em28xx *dev)
>>         struct em28xx_dvb *dvb;
>>         struct i2c_client *client;
>>
>> +       if (!dev)
>> +               return 0;
>> +
>>         if (dev->is_audio_only) {
>>                 /* Shouldn't initialize IR for this interface */
>>                 return 0;
>> --
>> 2.7.4
>>


From 1583514057628866606@xxx Wed Nov 08 15:58:06 +0000 2017
X-GM-THRID: 1583464386862260131
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread