05 Jun, 2019

1 commit


12 May, 2018

1 commit

  • During destruction, a race condition in
    dvb_media_controller_disable_source() can cause a kernel crash,
    because the "mdev" pointer has been read successfully while another
    task executes dvb_usb_media_device_unregister(), which destroys the
    object. Example for such a crash:

    general protection fault: 0000 [#1] SMP
    CPU: 1 PID: 301 Comm: vdr Not tainted 4.8.1-nuc+ #102
    [142B blob data]
    task: ffff8802301f2040 task.stack: ffff880233728000
    RIP: 0010:[] [] dvb_frontend_release+0xcb/0x120
    RSP: 0018:ffff88023372bdd8 EFLAGS: 00010202
    RAX: 001fd55c000000da RBX: ffff880236bad810 RCX: 0000000000000000
    RDX: ffff880235bd81f0 RSI: 0000000000000246 RDI: ffff880235bd81e8
    RBP: ffff88023372be00 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: ffff88022f009910 R12: 0000000000000000
    R13: ffff880235a21a80 R14: ffff880235bd8000 R15: ffff880235bb8a78
    FS: 0000000000000000(0000) GS:ffff88023fd00000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f96edd69818 CR3: 0000000002406000 CR4: 00000000001006e0
    Stack:
    ffff88022f009900 0000000000000008 ffff880235bb8a78 ffff8802344fbb20
    ffff880236437b40 ffff88023372be48 ffffffff8117a81e ffff880235bb8a78
    ffff88022f009910 ffff8802335a7400 ffff8802301f2040 ffff88022f009900
    Call Trace:
    [] __fput+0xde/0x1d0
    [] ____fput+0x9/0x10
    [] task_work_run+0x7e/0xa0
    [] do_exit+0x27b/0xa50
    [] ? __do_page_fault+0x1c3/0x430
    [] do_group_exit+0x42/0xb0
    [] SyS_exit_group+0xf/0x10
    [] entry_SYSCALL_64_fastpath+0x13/0x8f
    Code: 31 c9 49 8d be e8 01 00 00 ba 01 00 00 00 be 03 00 00 00 e8 68 2d a0 ff 48 8b 83 10 03 00 00 48 8b 80 88 00 00 00 48 85 c0 74 12 8b 80 88 02 00 00 48 85 c0 74 06 49 8b 7d
    RIP [] dvb_frontend_release+0xcb/0x120

    [mchehab+samsung@kernel.org: fix a Coding Style issue]
    Signed-off-by: Max Kellermann
    Signed-off-by: Mauro Carvalho Chehab

    Max Kellermann
     

07 Mar, 2018

1 commit


06 Mar, 2018

1 commit

  • The dvb_attach()/dvb_detach() methods are ugly hacks designed
    to keep using the I2C low-level API. The proper way is to
    do I2C bus bindings instead.

    Several modules were already converted to use it. Yet,
    it is painful to use it, as lots of code need to be
    duplicated.

    Make it easier by providing two new helper functions:
    - dvb_module_probe()
    - dvb_module_release()

    Signed-off-by: Mauro Carvalho Chehab

    Mauro Carvalho Chehab
     

05 Jan, 2018

1 commit


29 Dec, 2017

1 commit