• Mauro Carvalho Chehab's avatar
    [media] media-entity: cache media_device on object removal · cc4a8258
    Mauro Carvalho Chehab authored
    As pointed by Dan, the commit f8fd4c61b5ae ("[media] media-entity:
    protect object creation/removal using spin lock")' leads to the
    following static checker warning:
    
    	drivers/media/media-entity.c:781 media_remove_intf_link()
    	error: dereferencing freed memory 'link'
    
    drivers/media/media-entity.c
       777  void media_remove_intf_link(struct media_link *link)
       778  {
       779          spin_lock(&link->graph_obj.mdev->lock);
       780          __media_remove_intf_link(link);
       781          spin_unlock(&link->graph_obj.mdev->lock);
    
    In practice, I didn't see any troubles even with KASAN enabled. I guess
    gcc optimizer internally cached the mdev reference, instead of getting
    it twice. Yet, it is a very bad idea to rely on such optimization. So,
    let's fix the code.
    Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
    cc4a8258
media-entity.c 19.6 KB