Re: [PATCH] [media] tda18212: fix use-after-free in tda18212_remove()

2017-12-15 Thread Daniel Scheller
On Fri, 15 Dec 2017 21:06:32 +0200 Antti Palosaari wrote: > On 12/15/2017 08:40 PM, Daniel Scheller wrote: > > On Fri, 15 Dec 2017 20:12:18 +0200 > > Antti Palosaari wrote: > >> > >> em28xx does it currently just correct. > >> 1) unregister frontend > > > > Note that this is a call to em28xx_

Re: [PATCH] [media] tda18212: fix use-after-free in tda18212_remove()

2017-12-15 Thread Antti Palosaari
On 12/15/2017 08:40 PM, Daniel Scheller wrote: On Fri, 15 Dec 2017 20:12:18 +0200 Antti Palosaari wrote: On 12/15/2017 08:00 PM, Daniel Scheller wrote: Hi, On Fri, 15 Dec 2017 19:30:18 +0200 Antti Palosaari wrote: Thanks for your reply. Hello I think shared frontend structure, which

Re: [PATCH] [media] tda18212: fix use-after-free in tda18212_remove()

2017-12-15 Thread Daniel Scheller
On Fri, 15 Dec 2017 20:12:18 +0200 Antti Palosaari wrote: > On 12/15/2017 08:00 PM, Daniel Scheller wrote: > > Hi, > > > > On Fri, 15 Dec 2017 19:30:18 +0200 > > Antti Palosaari wrote: > > > > Thanks for your reply. > > > >> Hello > >> I think shared frontend structure, which is owned by de

Re: [PATCH] [media] tda18212: fix use-after-free in tda18212_remove()

2017-12-15 Thread Antti Palosaari
On 12/15/2017 08:00 PM, Daniel Scheller wrote: Hi, On Fri, 15 Dec 2017 19:30:18 +0200 Antti Palosaari wrote: Thanks for your reply. Hello I think shared frontend structure, which is owned by demod driver, should be there and valid on time tuner driver is removed. And thus should not happen

Re: [PATCH] [media] tda18212: fix use-after-free in tda18212_remove()

2017-12-15 Thread Daniel Scheller
Hi, On Fri, 15 Dec 2017 19:30:18 +0200 Antti Palosaari wrote: Thanks for your reply. > Hello > I think shared frontend structure, which is owned by demod driver, > should be there and valid on time tuner driver is removed. And thus > should not happen. Did you make driver unload on different

Re: [PATCH] [media] tda18212: fix use-after-free in tda18212_remove()

2017-12-15 Thread Antti Palosaari
Hello I think shared frontend structure, which is owned by demod driver, should be there and valid on time tuner driver is removed. And thus should not happen. Did you make driver unload on different order eg. not just reverse order than driver load? IMHO these should go always on load: 1) l

[PATCH] [media] tda18212: fix use-after-free in tda18212_remove()

2017-12-15 Thread Daniel Scheller
From: Daniel Scheller When the driver gets unloaded via it's tda18212_remove() function, all frontend structures may already have been freed as controlling/bridge drivers already used dvb_frontend_detach() in their teardown process. Since __dvb_frontend_free now releases and clears all structures