Commit e8123311 authored by Zheyu Ma's avatar Zheyu Ma Committed by Mauro Carvalho Chehab
Browse files

media: pci: cx23885: Fix the error handling in cx23885_initdev() 



When the driver fails to call the dma_set_mask(), the driver will get
the following splat:

[   55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240
[   55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590
[   55.856822] Call Trace:
[   55.860327]  __process_removed_driver+0x3c/0x240
[   55.861347]  bus_for_each_dev+0x102/0x160
[   55.861681]  i2c_del_driver+0x2f/0x50

This is because the driver has initialized the i2c related resources
in cx23885_dev_setup() but not released them in error handling, fix this
bug by modifying the error path that jumps after failing to call the
dma_set_mask().

Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent f83bd49c

drivers/media/pci/cx23885/cx23885-core.c

+3 −3
Original line number Diff line number Diff line
@@ -2165,7 +2165,7 @@ static int cx23885_initdev(struct pci_dev *pci_dev, 
	err = dma_set_mask(&pci_dev->dev, 0xffffffff);

	if (err) {

		pr_err("%s/0: Oops: no 32bit PCI DMA ???\n", dev->name);

		goto fail_ctrl;

		goto fail_dma_set_mask;

	}



	err = request_irq(pci_dev->irq, cx23885_irq,
@@ -2173,7 +2173,7 @@ static int cx23885_initdev(struct pci_dev *pci_dev, 
	if (err < 0) {

		pr_err("%s: can't get IRQ %d\n",

		       dev->name, pci_dev->irq);

		goto fail_irq;

		goto fail_dma_set_mask;

	}



	switch (dev->board) {
@@ -2195,7 +2195,7 @@ static int cx23885_initdev(struct pci_dev *pci_dev, 


	return 0;



fail_irq:

fail_dma_set_mask:

	cx23885_dev_unregister(dev);

fail_ctrl:

	v4l2_ctrl_handler_free(hdl);