media: cx231xx: fix use-after-free when unregistering the i2c_client for the dvb...
authorMatthias Schwarzott <zzam@gentoo.org>
Wed, 2 Aug 2017 16:46:00 +0000 (12:46 -0400)
committerMauro Carvalho Chehab <mchehab@s-opensource.com>
Sun, 27 Aug 2017 10:33:47 +0000 (06:33 -0400)
commite59eb4adf0d79fe7692c08c07445ec9efc8ddc1c
treec770a4bdb12f205cc26bb61a1bf7ad88abe4ccf9
parent412b16d623cf4fd794713f314db5aad10c46ad87
media: cx231xx: fix use-after-free when unregistering the i2c_client for the dvb demod

Calling i2c_unregister_device for a demod driver destroys the frontend object.
Later it is accessed by calling dvb_unregister_frontend and
dvb_frontend_detach.

In some cases this leads to a general protection fault with this
callstack:

  dvb_unregister_frontend+0x25/0x50 [dvb_core]
  dvb_fini+0xdb/0x160 [cx231xx_dvb]
  cx231xx_unregister_extension+0x3d/0xb0 [cx231xx]
  cx231xx_dvb_unregister+0x10/0x809 [cx231xx_dvb]
  SyS_delete_module+0x18a/0x240
  ? exit_to_usermode_loop+0x7b/0x80
  entry_SYSCALL_64_fastpath+0x17/0x98

Signed-off-by: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
drivers/media/usb/cx231xx/cx231xx-dvb.c