• Daniel Scheller's avatar
    media: ddbridge: fix teardown/deregistration order in ddb_input_detach() · 1502efd2
    Daniel Scheller authored
    Brought to attention by Matthias Schwarzott <zzam@gentoo.org> by fixing
    possible use-after-free faults in some demod drivers:
    
    In ddb_input_detach(), the i2c_client is unregistered and removed before
    dvb frontends are unregistered and detached. While no use-after-free issue
    was observed so far, there is another issue with this:
    
    dvb->attached keeps track of the state of the input/output registration,
    and the i2c_client unregistration takes place only if everything was
    successful (dvb->attached == 0x31). If for some reason an error occurred
    during the frontend setup, that value stays at 0x20. In the following
    error handling and cleanup, ddb_input_detach() will skip down to that
    state, leaving the i2c_client registered, causing refcount issues.
    
    Fix this by moving the i2c_client deregistration down to case 0x20.
    
    Cc: Matthias Schwarzott <zzam@gentoo.org>
    Signed-off-by: default avatarDaniel Scheller <d.scheller@gmx.net>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
    1502efd2
ddbridge-core.c 87.5 KB