On Mon Jul 20 13:17:08 2026 +0000, Fan Wu wrote:
> netup_ci_exit() frees a netup_ci_state while its work item,
> netup_read_ci_status(), may still be pending or running on the system
> workqueue. The worker obtains the state with container_of() and
> dereferences it, so it must not outlive the state.
>
> netup_ci_init() queues the initial status read, and CI GPIO interrupts
> subsequently queue the same work from netup_ci_slot_status(). During
> remove, cx23885_finidev() calls free_irq() before the CI device is
> unregistered. free_irq() prevents further IRQ handlers from running,
> but does not drain work queued previously, so the worker can run after
> netup_ci_exit() frees the state.
>
> Call cancel_work_sync() before dvb_ca_en50221_release() and kfree().
>
> This issue was found by an in-house static analysis tool.
>
> Fixes: c184dcd28233 ("V4L/DVB (10798): Add CIMax(R) SP2 Common Interface code
> for NetUP Dual DVB-S2 CI card")
> Cc: [email protected]
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/pci/cx23885/cimax2.c | 1 +
1 file changed, 1 insertion(+)
---
diff --git a/drivers/media/pci/cx23885/cimax2.c
b/drivers/media/pci/cx23885/cimax2.c
index 154918984534..723509fa1e06 100644
--- a/drivers/media/pci/cx23885/cimax2.c
+++ b/drivers/media/pci/cx23885/cimax2.c
@@ -528,6 +528,7 @@ void netup_ci_exit(struct cx23885_tsport *port)
if (NULL == state->ca.data)
return;
+ cancel_work_sync(&state->work);
dvb_ca_en50221_release(&state->ca);
kfree(state);
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
