| Message ID | 20241004-ub9xx-fixes-v1-1-e30a4633c786@ideasonboard.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | media: i2c: ds90ub9xx: Misc fixes and improvements | expand |
On Fri, Oct 04, 2024 at 05:46:32PM +0300, Tomi Valkeinen wrote: > The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as > part of their remove process, and if the driver is removed multiple > times, eventually leads to put "overflow", possibly causing memory > corruption or crash. > > The fwnode_handle_put() is a leftover from commit 905f88ccebb1 ("media: > i2c: ds90ub9x3: Fix sub-device matching"), which changed the code > related to the sd.fwnode, but missed removing these fwnode_handle_puts. fwnode_handle_put():s
diff --git a/drivers/media/i2c/ds90ub913.c b/drivers/media/i2c/ds90ub913.c index ca9bb29dab89..150d6641516f 100644 --- a/drivers/media/i2c/ds90ub913.c +++ b/drivers/media/i2c/ds90ub913.c @@ -793,7 +793,6 @@ static void ub913_subdev_uninit(struct ub913_data *priv) v4l2_async_unregister_subdev(&priv->sd); ub913_v4l2_nf_unregister(priv); v4l2_subdev_cleanup(&priv->sd); - fwnode_handle_put(priv->sd.fwnode); media_entity_cleanup(&priv->sd.entity); } diff --git a/drivers/media/i2c/ds90ub953.c b/drivers/media/i2c/ds90ub953.c index 16f88db14981..10daecf6f457 100644 --- a/drivers/media/i2c/ds90ub953.c +++ b/drivers/media/i2c/ds90ub953.c @@ -1291,7 +1291,6 @@ static void ub953_subdev_uninit(struct ub953_data *priv) v4l2_async_unregister_subdev(&priv->sd); ub953_v4l2_notifier_unregister(priv); v4l2_subdev_cleanup(&priv->sd); - fwnode_handle_put(priv->sd.fwnode); media_entity_cleanup(&priv->sd.entity); }
The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as part of their remove process, and if the driver is removed multiple times, eventually leads to put "overflow", possibly causing memory corruption or crash. The fwnode_handle_put() is a leftover from commit 905f88ccebb1 ("media: i2c: ds90ub9x3: Fix sub-device matching"), which changed the code related to the sd.fwnode, but missed removing these fwnode_handle_puts. Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Fixes: 905f88ccebb1 ("media: i2c: ds90ub9x3: Fix sub-device matching") --- drivers/media/i2c/ds90ub913.c | 1 - drivers/media/i2c/ds90ub953.c | 1 - 2 files changed, 2 deletions(-)