Unverified Commit 4b20dfe7 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1274 [sync] PR-1253: media: saa7134: fix use after free bug in... 

!1274 [sync] PR-1253:  media: saa7134: fix use after free bug in saa7134_finidev due to race condition

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1253 
 
PR sync from: Longlong Xia <xialonglong1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/O25ROO7NSR27YAETYTL5DMZW7DV6CNOO/ 
 
 
Link:https://gitee.com/openeuler/kernel/pulls/1274

 

Reviewed-by: default avatarKefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 24392e45 2776acc3

drivers/media/pci/saa7134/saa7134-ts.c

+1 −0
Original line number Diff line number Diff line
@@ -300,6 +300,7 @@ int saa7134_ts_start(struct saa7134_dev *dev) 


int saa7134_ts_fini(struct saa7134_dev *dev)

{

	del_timer_sync(&dev->ts_q.timeout);

	saa7134_pgtable_free(dev->pci, &dev->ts_q.pt);

	return 0;

}

drivers/media/pci/saa7134/saa7134-vbi.c

+1 −0
Original line number Diff line number Diff line
@@ -185,6 +185,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev) 
int saa7134_vbi_fini(struct saa7134_dev *dev)

{

	/* nothing */

	del_timer_sync(&dev->vbi_q.timeout);

	return 0;

}

drivers/media/pci/saa7134/saa7134-video.c

+1 −0
Original line number Diff line number Diff line
@@ -2153,6 +2153,7 @@ int saa7134_video_init1(struct saa7134_dev *dev) 


void saa7134_video_fini(struct saa7134_dev *dev)

{

	del_timer_sync(&dev->video_q.timeout);

	/* free stuff */

	saa7134_pgtable_free(dev->pci, &dev->video_q.pt);

	saa7134_pgtable_free(dev->pci, &dev->vbi_q.pt);