[pvrusb2] [PATCH] pvrusb2: Fix oops on tear-down when radio support is not present

[Diego Rivera]

The build is off to the races (24 thread concurrency), with the patch incorporated. It was offset by
10 lines, and had to ignore whitespace (for some reason the Ubuntu folks seem to have changed some
indents to tabs...but only *some*....oh well).
I'll let you know when it's ready and running.
Cheers!
On Sun, 2019-10-27 at 16:00 -0600, Diego Rivera wrote:
> I'll do that today. I'm setting up a kernel build system now, should be able to fire off a build
> soon.
> Cheers!
> -- 
> 
> 
> 
> Diego Rivera
> 
> On Sun, 2019-10-27 at 16:47 -0500, Mike Isely wrote:
> > If I can get independent confirmation that this definitely helps matters, I will post the patch
> > upstream.  Just being absolutely paranoid...
> >   -Mike
> > On Sun, 27 Oct 2019, Mike Isely wrote:
> > > In some device configurations there's no radio or radio support in thedriver.  That's OK, as
> > > the driver sets itself up accordingly.  Howeveron tear-down in these caes it's still trying to
> > > tear down radiorelated context when there isn't anything there, leading todereferences through
> > > a null pointer and chaos follows.
> > > How this bug survived unfixed for 11 years in the pvrusb2 driver is a mystery to me.
> > > Signed-off-by: Mike Isely <isely at pobox.com>--- drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 8
> > > ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
> > > diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-
> > > v4l2.cindex aa4fbc3e88cc..0a831849a2b0 100644--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c+++ 
> > > b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c@@ -909,8 +909,11 @@ static void
> > > pvr2_v4l2_internal_check(struct pvr2_channel *chp) 	pvr2_v4l2_dev_disassociate_parent(vp
> > > ->dev_video); 	pvr2_v4l2_dev_disassociate_parent(vp->dev_radio); 	if (!list_empty(&vp-
> > > >dev_video->devbase.fh_list) ||-	    !list_empty(&vp->dev_radio->devbase.fh_list))+	    ((
> > > vp->dev_radio != NULL) &&+	     !list_empty(&vp->dev_radio->devbase.fh_list))) {+	
> > > 	pvr2_trace(PVR2_TRACE_STRUCT,"pvr2_v4l2 internal_check exit-empty id=%p",vp); 		
> > > return;+	} 	pvr2_v4l2_destroy_no_lock(vp); } @@ -946,7 +949,8 @@ static int
> > > pvr2_v4l2_release(struct file *file) 	kfree(fhp); 	if (vp->channel.mc_head-
> > > >disconnect_flag && 	    list_empty(&vp->dev_video->devbase.fh_list) &&-	    list_empty
> > > (&vp->dev_radio->devbase.fh_list)) {+	    ((vp->dev_radio == NULL) ||+	     list_empt
> > > y(&vp->dev_radio->devbase.fh_list))) { 		pvr2_v4l2_destroy_no_lock(vp); 	} 	
> > > return 0;-- 2.20.1_______________________________________________pvrusb2 mailing 
> > > listpvrusb2 at isely.net
> > > http://www.isely.net/cgi-bin/mailman/listinfo/pvrusb2
> > > 
-- 



Diego Rivera

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: This is a digitally signed message part
URL: <http://www.isely.net/pipermail/pvrusb2/attachments/20191027/0da86240/attachment.sig>