media: pci: cx23885: Fix the error handling in cx23885_initdev()
authorZheyu Ma <zheyuma97@gmail.com>
Sun, 10 Apr 2022 07:34:41 +0000 (08:34 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 9 Jun 2022 08:22:33 +0000 (10:22 +0200)
commit98106f100f50c487469903b9cf6d966785fc9cc3
treecb0f5f6525a01d54fa4b31b68d0857d61a7a1b7c
parent9c385b961d4c378228e80f6abea8509cb67feab6
media: pci: cx23885: Fix the error handling in cx23885_initdev()

[ Upstream commit e8123311cf06d7dae71e8c5fe78e0510d20cd30b ]

When the driver fails to call the dma_set_mask(), the driver will get
the following splat:

[   55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240
[   55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590
[   55.856822] Call Trace:
[   55.860327]  __process_removed_driver+0x3c/0x240
[   55.861347]  bus_for_each_dev+0x102/0x160
[   55.861681]  i2c_del_driver+0x2f/0x50

This is because the driver has initialized the i2c related resources
in cx23885_dev_setup() but not released them in error handling, fix this
bug by modifying the error path that jumps after failing to call the
dma_set_mask().

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/media/pci/cx23885/cx23885-core.c